Archiving and eDiscovery for Collaboration Systems

Michael Sampson — Tue, 24 Nov 2009 18:49:24 +0000

Archiving and eDiscovery for email are a well-understood, even if not so well-practiced set of requirements; but compared to the current status of archiving and eDiscovery for collaboration systems, it’s the gold standard. In the email archiving space, there are many vendors and signs of market maturity. For example, the acquisitions to consolidate capability and acquire new technology. There are also examples from courts where email evidence has been critical, and given the back-and-forth conversational and interactional nature of email, archiving email messages is not hard.

Life is a bit more complex when it comes to collaboration systems though, and for our purposes, that means systems like SharePoint, Lotus Quickr, Lotus Connections, Oracle Beehive, Central Desktop, Socialtext, and many, many more. What follows is a look at current regulations, a discussion about archiving and eDiscovery for collaboration systems, and some thoughts about what this means for organizations.

Regulations

A wide range of regulations and statutes require organizations to safeguard and manage complete records that document what happened in a business or organization. Financial services companies are subject to SEC and FINRA regulations, life sciences organizations to 21 CFR Part 11, federal government agencies and defense contractors to DoD 5015.2, and companies publicly traded in U.S. markets to Sarbanes-Oxley. Common among these regulations and statutes is the concept that the subject matter determines what needs to be managed, and not the medium used for transmitting or communicating information in the record. This means that business decisions communicated through collaboration systems are just as relevant for records management as a printed contract. A second point of commonality is that a complete record is required, not a haphazard or partial one. And third, once a record has been captured and stored, it must be safeguarded from unauthorized change, and if it is changed, an audit trail of all changes must be maintained. The courts have demonstrated a willingness to enforce compliance with records management regulations, and there are steep costs for non-compliance.

Beyond compliance with external regulations, though, there is a need to ensure a complete business record is maintained for legal discovery. For companies dealing with litigation matters, the cost of locating and retrieving the requested records can rapidly rise to hundreds of thousands of dollars per request. Organizations with appropriate record management strategies, systems, and procedures can minimize these costs.

Archiving

Collaboration systems are not exempt from archiving requirements. In fact, as more and more work gets done inside collaboration systems, there will be a greater need for archiving what was discussed, agreed, and promised. Organizations with SharePoint are well supported in their quest for archiving what takes place inside collaborative team sites. AvePoint, EMC, Metalogix, Mimosa Systems, and many others provide archiving add-on tools for SharePoint. For example, AvePoint DocAve Vault—AvePoint’s archiving tool for SharePoint—will automatically copy and store all SharePoint records and metadata without any need for user intervention. End-users continue to do their work, and DocAve Vault stores a record of what they did. EMC Documentum Archive Services for SharePoint, EMC’s offering, will copy or move content out of SharePoint 2007 and into Documentum for archival purposes.

Other collaboration systems are not so well supported by archiving vendors. IBM supports archiving a complete Lotus Quickr space, not individual items therein, although ZL Technologies does support more fine-grained archiving of Quickr activity. Central Desktop, 37signals Basecamp, Socialtext and more all take the same approach: you can archive a complete space/project/ wiki, but item-level archiving is not supported out-of-the-box. It gets more complex in the wiki world too. What exactly does archiving mean for a wiki? Does it mean that you have to archive every page edition, and the metadata of when it was valid, and which people read or saw that particular edition? That’s going to get messy very quickly.

eDiscovery

One main purpose for archiving your electronic records is to prove what was or wasn’t said to others; hence the need for a complete business record. Basic requirements in eDiscovery involve searching for electronic items that match a discovery request, and then creating a legal hold on those items. A legal hold means that any standard disposition (automatic deletion) policies may not be applied to content under the legal hold, and that all items under the legal hold are unable to be changed or modified, unless a full record of those changes are maintained. Some collaboration systems support eDiscovery requirements out-of-the-box, some can be integrated into third-party products for eDiscovery, and some are an open question (or an eDiscovery nightmare, depending on how you look at it).

In SharePoint, the out-of-the-box Records Center site enables content to be copied from other collaborative sites, and then broken down by type of content and stored in a records center. This means that the collaborative working out of the document or item happens in a collaboration team site. Once the document or item has been completed or finalized, or some other way subject to workflow or timing, a copy of the document or item is made in the appropriate Records Center site. Within the Records Center, there are capabilities for Legal Holds and more. Equally, organizations with SharePoint can elect to integrate with third-party records management systems, and use the capabilities of the wider platform for eDiscovery and legal holds.

Closing Thoughts

Because collaboration systems are becoming such an integral part of doing business, it is important to also include these systems when complying with regulations and eDiscovery requirements. Now is the time to do your due diligence about which regulations you have to comply with, and then to ensure that whatever systems you allow to be used within your organization can meet these regulations. Further, when selecting collaboration systems, be sure to include supporting archiving regulations and eDiscovery requirements as a part of your upfront decision criteria.