What to Archive?
There are no hard and fast rules on what to archive. "This is an old debate: save nothing vs. save everything," says Spurzem. "The argument against save nothing is that it does not work, because you may delete email on your server, but it may also exist on a home email account, or a local PST file. Because you cannot guarantee the email is totally deleted, you may as well keep a copy, just in case you end up in court. The argument against save everything is based on the cost of storage. Storage costs are dropping, but it is still expensive to manage large disk storage systems." Spurzem believes the likely best choice is to compromise and save intelligently. He says to apply retention periods to employees depending on their position and other factors. "With a firm policy in place and the evidence that it is being adhered to with best practices, no court is going to penalize you. A sound policy combined with a sound email archival solution is the best solution," recommends Spurzem.
But the compromise can be difficult to reach. As Lock asks, "How do you not choose save everything?" Because email is extremely high volume, Lock recommends the decision be automated. "If not, the least of your worries are going to be storage costs. There are easy and clear decisions like all communications for specific employees and groups that can limit the amount archived. The important point this brings to light is just how critical good antispam technologies are, along with the mechanisms that do not accept unsolicited bulk email." Retention policies will vary by functional area. "Human Resources require longer terms of retention, sometimes upward of 10 years," notes D'Arcy. "Finance and executive management might also require a specific set of policies. The philosophy varies wildly. Some organizations think that every email is a potential smoking gun and prefer to make their email retention policy as short as possible. Some feel that the defense values of the email is much more important than running the risk of not being able to produce an email. Both of these approaches would be correct."