Effective Email Management for the Organization Jesse Wilkins February 22, 2008

Agenda Email management drivers Email management today Managing the inbox Capturing and classifying messages Email management technologies Elements of an email policy

Email management drivers

Email management today

Managing the inbox

Capturing and classifying messages

Email management technologies

Elements of an email policy

EMAIL MANAGEMENT DRIVERS

Email – defining the issue First email was sent in 1971 Today more email is sent every day than the USPS delivers in a year 11 billion emails a day in the US alone More than 57 billion a day world-wide NOT including spam 60% or more of business-critical information is stored within messaging systems

First email was sent in 1971

Today more email is sent every day than the USPS delivers in a year

11 billion emails a day in the US alone

More than 57 billion a day world-wide

NOT including spam

60% or more of business-critical information is stored within messaging systems

Why are we sending so much email? It’s easy It’s asynchronous It’s convenient It’s less formal It’s ubiquitous and platform-neutral There’s a written record of communication

It’s easy

It’s asynchronous

It’s convenient

It’s less formal

It’s ubiquitous and platform-neutral

There’s a written record of communication

Business issues Email storage costs Up to 200 GB email per month for 1,000-user company Costs to add and manage storage Costs to back up to tape Costs to restore Productivity costs

Email storage costs

Up to 200 GB email per month for 1,000-user company

Costs to add and manage storage

Costs to back up to tape

Costs to restore

Productivity costs

Business issues cont’d Email retrieval costs It takes more than 11 hours to recover an email more than 1 year old from an archive Typically have to restore the entire tape to a spare (!) server to find the desired message 29% of organizations would not be able to restore an email message over 6 months old

Email retrieval costs

It takes more than 11 hours to recover an email more than 1 year old from an archive

Typically have to restore the entire tape to a spare (!) server to find the desired message

29% of organizations would not be able to restore an email message over 6 months old

Legal issues Electronic discovery for a Fortune 500 company averages $750,000 per case 75% of demands for discovery are for email Courts want discovery in native format… … but may also require that it be provided in an accessible format

Electronic discovery for a Fortune 500 company averages $750,000 per case

75% of demands for discovery are for email

Courts want discovery in native format…

… but may also require that it be provided in an accessible format

Email and the FRCP Email is ESI and must be produced Litigation holds need to include email systems, clients, backups, and archives Organizations need to know what they have and where it is located Time to locate email is before litigation begins

Email is ESI and must be produced

Litigation holds need to include email systems, clients, backups, and archives

Organizations need to know what they have and where it is located

Time to locate email is before litigation begins

Legal considerations for messages Messages are discoverable – whether they are records or not Message archives are discoverable, regardless of the format or storage medium The “deleted messages box” is discoverable Personal copies are discoverable

Messages are discoverable – whether they are records or not

Message archives are discoverable, regardless of the format or storage medium

The “deleted messages box” is discoverable

Personal copies are discoverable

Regulatory and recordkeeping issues Email messages might be records – but email is NOT a series! Email has to be accessible today…and tomorrow Email systems and formats Attachments and their formats Media and hardware issues

Email messages might be records – but email is NOT a series!

Email has to be accessible today…and tomorrow

Email systems and formats

Attachments and their formats

Media and hardware issues

When is an email a record? When statutorily defined When it documents a business transaction When it supports a business decision When the attachment is a record When it is the only written record of something

When statutorily defined

When it documents a business transaction

When it supports a business decision

When the attachment

is a record

When it is the only written

record of something

EMAIL MANAGEMENT TODAY

Email management defined According to AIIM, The ECM Association, the essence of email management is that “ As the de facto standard for business communication, removing emails from the server and saving them to a repository isn't enough. Email must be classified, stored, and destroyed consistent with business standards-just as any other document or record.”

According to AIIM, The ECM Association, the essence of email management is that

“ As the de facto standard for business communication, removing emails from the server and saving them to a repository isn't enough. Email must be classified, stored, and destroyed consistent with business standards-just as any other document or record.”

Email management is NOT: Saving all email messages forever Saving all email messages in the messaging application Setting mailbox time limits Setting mailbox size limits Declaring “email” as a record series Doing nothing

Saving all email messages forever

Saving all email messages in the messaging application

Setting mailbox time limits

Setting mailbox size limits

Declaring “email” as a record series

Doing nothing

Approaches to managing email today Policy approaches to retention: Do nothing Let users manage their own email Keep everything forever Delete all messages older than X Limit mailbox size to X Declare and manage email as records

Policy approaches to retention:

Do nothing

Let users manage their own email

Keep everything forever

Delete all messages older than X

Limit mailbox size to X

Declare and manage email as records

Approaches to managing email today Technology approaches to retention: Outsource it! Server-based rules Client-based rules Decentralized – employees do it Messages on the server Messages in .PST/.NSF files

Technology approaches to retention:

Outsource it!

Server-based rules

Client-based rules

Decentralized – employees do it

Messages on the server

Messages in .PST/.NSF files

MANAGING THE INBOX

Managing the email messages Messages themselves Read receipts Bounced messages Attachments All of these could be records Even if they are not records they must be managed

Messages themselves

Read receipts

Bounced messages

Attachments

All of these could be records

Even if they are not records

they must be managed

Other information objects Many others in the email environment Calendar items and appointments Task items Notes Contacts

Many others in the email environment

Calendar items and appointments

Task items

Notes

Contacts

Where to find email on the client In the Inbox In personal folders in the Inbox In Sent folder In Deleted folder In the Junk folder As individual messages on the PC In .PST or .NSF files

In the Inbox

In personal folders in the Inbox

In Sent folder

In Deleted folder

In the Junk folder

As individual messages

on the PC

In .PST or .NSF files

Where to find email on the server In the email server itself In an email archiving application In an ECM or ERM system On backup or archival media On the J: drive In other peoples’ email accounts

In the email server itself

In an email archiving application

In an ECM or ERM system

On backup or archival media

On the J: drive

In other peoples’ email accounts

Other email storage locations Printed On removable storage devices On home PCs and laptops On PDAs and smart phones In home or personal email accounts In commercial web-based email accounts Outside the organization

Printed

On removable storage devices

On home PCs and laptops

On PDAs and smart phones

In home or personal email accounts

In commercial web-based email accounts

Outside the organization

General principles Email management is part of time management Email is a medium, not an action Email should not be used for everything Email should be kept as long as needed – and no longer

Email management is part of time management

Email is a medium, not an action

Email should not be used for everything

Email should be kept as long as needed – and no longer

Inbox management model Set up rules for “important” vs. routine messages Consider turning off alerts for incoming messages Make rules about which messages have alerts Define specific times to check email

Set up rules for “important” vs. routine messages

Consider turning off alerts for incoming messages

Make rules about which messages have alerts

Define specific times to check email

Reduce your email traffic Lots of email traffic is external opt-in “ Bacn” Some is internal but unnecessary “ Colleague spam” Determine the value provided Use other tools for transitory information IM, phone, face-to-face

Lots of email traffic is external opt-in

“ Bacn”

Some is internal but unnecessary

“ Colleague spam”

Determine the value provided

Use other tools for transitory information

IM, phone, face-to-face

CAPTURING AND CLASSIFYING MESSAGES

Capturing email records Capture messages that have value Administrative, fiscal, historical, or legal Not everything needs to be captured Keep them according to retention Remember that others may have copies

Capture messages that have value

Administrative, fiscal, historical, or legal

Not everything needs to be captured

Keep them according to retention

Remember that others may have copies

Capturing email records Capture and manage messages Manage attachments Capture metadata Name of sender and addressees Date/time sent Other transmission data as necessary May also need to capture calendar items, receipts, CC/BCCs…

Capture and manage messages

Manage attachments

Capture metadata

Name of sender and addressees

Date/time sent

Other transmission data as necessary

May also need to capture

calendar items, receipts,

CC/BCCs…

Who captures the message? YOU have to capture an email: You receive from outside the organization You send, either internally or to someone outside the organization Designate someone to capture messages sent to groups/lists

YOU have to capture an email:

You receive from outside the organization

You send, either internally or to someone outside the organization

Designate someone to

capture messages sent to groups/lists

Emails that are not captured Transitory messages that are not timely Personal messages unrelated to business “ Me-too” messages Messages already captured by someone else

Transitory messages that are not timely

Personal messages unrelated to business

“ Me-too” messages

Messages already captured by someone else

Emails that are not captured Messages that are not records and not supporting documentation can be deleted Delete manually Assumes users will do it Delete automatically By mailbox age By mailbox size

Messages that are not records and not supporting documentation can be deleted

Delete manually

Assumes users will do it

Delete automatically

By mailbox age

By mailbox size

Classifying messages Group messages according to some property By sender/recipient By topic By date Many different approaches to classification

Group messages according to some property

By sender/recipient

By topic

By date

Many different approaches to classification

Benefits of classification Providing linkages between individual records which accumulate to provide a continuous record of activity Ensuring records are named in a consistent manner over time Assisting in the retrieval of all records relating to a particular function or activity Determining security protection and access appropriate for sets of records

Providing linkages between individual records which accumulate to provide a continuous record of activity

Ensuring records are named in a consistent manner over time

Assisting in the retrieval of all records relating to a particular function or activity

Determining security protection and access appropriate for sets of records

Benefits of classification cont’d Allocating user permissions for access to, or action on, particular groups of records Distributing responsibility for management of particular sets of records Distributing records for action Determining appropriate retention periods and disposition actions for records Source: ISO 15489

Allocating user permissions for access to, or action on, particular groups of records

Distributing responsibility for management of particular sets of records

Distributing records for action

Determining appropriate retention periods and disposition actions for records

Source: ISO 15489

Classification structures Automatic categorization User-defined categories Departmental- or process-defined categories Enterprise taxonomy Retention schedule Roughly in order from least to most structure

Automatic categorization

User-defined categories

Departmental- or process-defined categories

Enterprise taxonomy

Retention schedule

Roughly in order from least to most structure

Classification approaches Manually, into folders Manually, using tags Automatically, using rules Client-side Server-side

Manually, into folders

Manually, using tags

Automatically, using rules

Client-side

Server-side

EMAIL MANAGEMENT TECHNOLOGIES

Technologies for managing email Email messaging applications Print & file Backup tapes Email management applications ECRM solutions Outsourced email solutions

Email messaging applications

Print & file

Backup tapes

Email management applications

ECRM solutions

Outsourced email solutions

Messaging system Not built to store massive amounts of messages And attachments And manage as records Difficult to search across inboxes Discovery, auditing

Not built to store massive amounts of messages

And attachments

And manage as records

Difficult to search across

inboxes

Discovery, auditing

Print & file Common approach Challenges: Loss of metadata Attachments Typical threaded email message Volume to print and to file Authenticity (phishing)

Common approach

Challenges:

Loss of metadata

Attachments

Typical threaded email

message

Volume to print and to file

Authenticity (phishing)

Backup tapes Archival vs. backup Backups store data, not files or messages Multiple copies of data Readability of older tapes Format, media, hardware

Archival vs. backup

Backups store data, not files or messages

Multiple copies of data

Readability of older tapes

Format, media, hardware

Email management applications Move messages out of the messaging application Typically use a rules engine May provide simple retention management Single instance storage Many different capabilities available

Move messages out of the messaging application

Typically use a rules engine

May provide simple retention management

Single instance storage

Many different capabilities available

Email management technologies Email archiving Personal archive file management Email encryption and digital signatures Email compliance Email discovery Email security Policy management

Email archiving

Personal archive file management

Email encryption and digital signatures

Email compliance

Email discovery

Email security

Policy management

ECRM solutions Most systems support email management May run at server or client Many support single-instance storage May allow declaration, management of messages as records Varying support for attachment management, metadata management

Most systems support email management

May run at server or client

Many support single-instance storage

May allow declaration, management of messages as records

Varying support for attachment management, metadata management

Outsourced solutions Let someone else manage it! Microsoft Exchange Hosted Services Gmail, Yahoo, Hotmail Many smaller/specialty providers Security considerations Privacy considerations Recordkeeping and discovery issues

Let someone else manage it!

Microsoft Exchange Hosted Services

Gmail, Yahoo, Hotmail

Many smaller/specialty providers

Security considerations

Privacy considerations

Recordkeeping and

discovery issues

.PST and .NSF Files Personal archive files Used to store messages locally on PCs .PST files present a number of issues Lack of backup Multiple .PST files! Difficult to share, may have passwords Inefficient storage

Personal archive files

Used to store messages locally on PCs

.PST files present a number of issues

Lack of backup

Multiple .PST files!

Difficult to share, may have passwords

Inefficient storage

Managing .PST and .NSF Files Don’t allow them Require them to be stored on a networked location that can be backed up Use technology to ingest, de-duplicate, index, and manage messages in them Or index them in place

Don’t allow them

Require them to be stored on a networked location that can be backed up

Use technology to ingest, de-duplicate, index, and manage messages in them

Or index them in place

Email preservation issues Format of information HTML, RTF, text Format of message .msg, .eml, .txt, others Format of attachment(s) Format of backup Format of archive Media and hardware

Format of information

HTML, RTF, text

Format of message

.msg, .eml, .txt, others

Format of attachment(s)

Format of backup

Format of archive

Media and hardware

Selecting the right solution Determine organizational requirements Determine what is in place Determine what technology is needed to address the gap Research available solutions based on architecture, deployment model, pricing, and capabilities

Determine organizational requirements

Determine what is in place

Determine what technology is needed to address the gap

Research available solutions based on architecture, deployment model, pricing, and capabilities

ELEMENTS OF AN EMAIL POLICY

Email policy principles Email belongs to the organization, not the individual Email is not a records series unto itself Email management program must comply with appropriate regulatory requirements Policy has to be followed and enforced!

Email belongs to the organization, not the individual

Email is not a records series unto itself

Email management program must comply with appropriate regulatory requirements

Policy has to be followed and enforced!

Email policy elements Acceptable/appropriate usage Personal usage Access to external messaging systems Effective email usage Ownership of email

Acceptable/appropriate usage

Personal usage

Access to external messaging systems

Effective email usage

Ownership of email

Elements of an email policy Retention and disposition Legal issues Holds Discovery and production Mobile and web-based email Backups Archival

Retention and disposition

Legal issues

Holds

Discovery and production

Mobile and web-based email

Backups

Archival

Elements of an email policy Privacy Security Retention and disposition Training Audit and compliance

Privacy

Security

Retention and disposition

Training

Audit and compliance

Questions?

Conclusion We have to manage messaging technologies better It starts with policies and procedures Technology can help Communicate, communicate, communicate Enforce the program

We have to manage messaging technologies better

It starts with policies and procedures

Technology can help

Communicate, communicate, communicate

Enforce the program

Additional resources E-Mail Rules , Nancy Flynn and Randolph Kahn Esq., ePolicy Institute ANSI/ARMA 9-2004, Requirements for the Management of Electronic Messages as Records , ARMA International ANSI/ARMA TR2-2007, Procedures and Issues for Managing Electronic Messages as Records , ARMA International

E-Mail Rules , Nancy Flynn and Randolph Kahn Esq., ePolicy Institute

ANSI/ARMA 9-2004, Requirements for the Management of Electronic Messages as Records , ARMA International

ANSI/ARMA TR2-2007, Procedures and Issues for Managing Electronic Messages as Records , ARMA International

Additional resources AIIM Email Management Certificate Program Policy Builder by Fortiva and The Electronic Communications Compliance Council (TEC3), http://www.policy-builder.com

AIIM Email Management Certificate Program

Policy Builder by Fortiva and The Electronic Communications Compliance Council (TEC3), http://www.policy-builder.com

For more information Jesse Wilkins CDIA+, LIT, edp, ICP, erm m , ecm m , bpm s Access Sciences Corporation [email_address] http://www.accesssciences.com Blog: http://informata.blogspot.com (303) 574-1455 direct

Jesse Wilkins

CDIA+, LIT, edp, ICP, erm m , ecm m , bpm s

Access Sciences Corporation

[email_address]

http://www.accesssciences.com

Blog: http://informata.blogspot.com

(303) 574-1455 direct