10 Best Practices For Archiving: A White Paper, Sponsored by Quest Software

10 Best Practices for Archiving
A White Paper, Sponsored by Quest Software
Copyright 2007 Contoural, Inc.
10 Best Practices of Archiving Whitepaper
Note: Legal information is not legal advice. Contoural provides information pertaining to business, compliance, and litigation trends and issues for educational and planning purposes. Contoural and its consultants do not provide legal advice. Readers should consult with competent legal counsel.
Introduction ...........................................................................................................3 Business drivers for archiving............................................................................3 What is a best practice? ....................................................................................4 10 Best Practices for Archiving .............................................................................6 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. Engage Key Stakeholders...........................................................................6 Clearly Define the Needs and Objectives....................................................6 Consider Search and Tagging Requirements .............................................7 Automate the Archiving Process .................................................................8 Start Archiving Now and Backfill Over Time................................................8 Use Reporting Features to Improve Efficiency and Effectiveness...............9 Retention Periods: Make it Simple ...........................................................10 Retention Periods: Exceptions as Needed...............................................10 Employee Education & Training ................................................................11 Define or Update a Record Retention Policy and Schedule...................12
Conclusion ..........................................................................................................13 About the Author - Stephen Foskett....................................................................14 About Contoural, Inc. ..........................................................................................14 About Quest Software, Inc. .................................................................................15
Copyright 2007 Contoural, Inc
Page 2 of 15
Introduction
Although data privacy and identity theft have a higher profile in the minds of consumers, data retention issues can have a far greater financial impact on businesses. Every company, whether public or private, large or small, must have a policy and enforcement system to deal with the messages and files generated by the organization every day. E-mail has become especially important, since it has become the dominant form of business communication. Data retention policies generally exist to allow companies to comply with regulations or address legal entanglements. But although most companies understand the need for such a policy, few have reliably implemented it: Osterman Research shows that although 43% of surveyed companies had a policy for e-mail retention, only 12% automated compliance with an archiving solution. The rest presumably rely on backup systems and end-user habits to protect e-mail, neither of which is a reliable option. Legal experts tell us that having a policy that is not enforced causes greater harm during litigation than having no policy all. In some instances, messaging applications may have the ability to create and manage historic archives of their own data. However, this capability is an extremely uncommon feature. Instead, third-party solutions are usually required to add archiving functionality to existing applications. Business drivers for archiving
So why archive data at all? Wouldnt it just be simpler to delete every e-mail message and file after a specified period of time, making the assumption that computer data is ephemeral? There would be significantly less storage expense with this universal deletion method, but it has never been successful. Practically speaking, there is no guarantee that an e-mail message has been deleted; another copy of every message exists on the receiving end, and messages can easily be copied, forwarded, or saved in a variety of locations. As long as deletion cannot be guaranteed, a policy of universal deletion could open the company to prosecution for ineffective enforcement. The drivers for electronic data archiving have traditionally been similar to those for hard-copy business records - litigation and compliance with internal rules or external regulations, and storage management savings. Response to litigationrelated e-discovery and document production requests are one of the most common needs met by an effective data archiving solution. An enterprise archiving solution can reduce or eliminate the need to search backup tapes and other sources for messages, documents, and data. Archiving solutions can also reconcile redundant data sources, reducing the amount of duplicated information that must be examined by counsel, further saving costs. Many archiving
The drivers for electronic data archiving have traditionally been similar to those for hard copy business records - litigation and compliance with internal rules or external regulations, and storage management savings.
Page 3 of 15
solutions also have advanced indexing and searching features, which allow documents to be marked for review, retention, or production. Compliance with internal policies or external regulations often requires examination of historical messages, documents and data, some of which may no longer be contained on active storage systems. Archiving solutions can capture, retain, and index that information, and offer additional policy tools that allow document classification according to business rules to help ensure compliance with retention policies. Operational business needs may require archiving old messages, documents and data. Having a consistent and easy-to-use archive allows data to be removed from production systems, decreasing system load and improving performance. An archive solution can also reduce storage costs, since only files that are actively being used need to be maintained on expensive production systems. Archiving can also assist in centralization of data, moving information from the edge to the core of the data center where policies can be enforced for the protection, indexing, retrieval and management of data. Finally, archiving technology can be used in the process of migrating data from one application to another. Archiving content before a software migration can be a powerful way to reduce the amount of data to be moved and integrated. An archiving solution can also help move data from one format to another translating it by storing one proprietary applications data in an archive format and then injecting it into the new system. Using archiving prior to a migration also helps clean up old data, keeping it from ever being added to the new system, while keeping it accessible if needed. Some archiving software vendors have begun to feature migration as an additional use for their offerings. Buying a solution from a migration-savvy company promises to ease the implementation of this technique. What is a best practice?
Generally, a best practice meets three key criteria: it is sensible and logical; the risks are low; and it is in widespread use.
Generally, a best practice meets three key criteria: it is sensible and logical, low-risk, and in widespread use. Although policies vary based on business circumstances, some universal best practices can be distilled from the experience of many organizations.
In the world of financial management, the prudent man rule is often applied. The rule states that financial investments should be managed how men of prudence, discretion and intelligence manage their own affairs. This sentiment can be extended into the world of information technology as a basic rule of prudence is the practice a good idea? Does it seem wise? Is a solution being forced somewhere it does not belong? The essence of a best practice asks: Is it a sensible thing to do?
Page 4 of 15
The second element is the quality of risk. Many practices in IT seem sensible and are widely used but have unacceptable risk levels to be considered best practices. For example, relying on a backup system to provide historic data recovery is a widespread practice that does not produce acceptable results. Old backup tapes can be difficult to index, ingest into a newer backup system, and they are often misplaced or damaged. Instead, dedicated archiving systems are more likely to allow document recovery and are thus best practice for historic retention purposes. The final key element of a best-practice asks: Is it in widespread use? Maintaining system availability requires IT to be managed in a conservative fashion. In general, no untried solutions should be brought to production. This does not imply, however, that no new techniques should be adopted. Rather, appropriate solutions should be chosen according to the sensitivity of the systems involved. If a sensible solution is widely used for similar applications, it is well on its way to becoming a best practice.
Page 5 of 15
10 Best Practices for Archiving

Using these three key criteria to cull Contourals experience in the field of data archiving produces the following list of best practices. Although Contoural believes these to be widely applicable, they are not universal and certain situations may require them to be modified or ignored. On the whole, however, IT managers should feel comfortable applying these practices to their data archiving needs. 1. Engage Key Stakeholders A successful archiving system must incorporate input from a variety of stakeholders both inside and outside the IT department. Understanding the intent of the solution is necessary for successful outcome, whether it is for litigation readiness, regulatory compliance, business productivity, or perhaps all three. It is likely that a variety of inputs will broaden the scope of the solution, increasing its impact on the business. Create a steering committee from the outset consisting of both in-house and outside legal counsel, human resources, finance, compliance and records management officers, and key individuals from all lines of business as well as the information technology staff. This may be the first time that such a diverse group has been brought together as part of an information technology project, but the nature of archiving demands this level of heterogeneous input. Especially important is the creation of a bridge between legal and information technology. Since an archiving solution could serve as a litigation e-discovery repository as well as for enforcement of regulatory compliance, it is critical that the needs of the legal staff are understood and met. 2. Clearly Define the Needs and Objectives To help you understand the archiving needs of your organization, take time to interview representatives from a wide variety of business departments. Determine what record types are currently kept, what regulations must be met, and what business needs exist for historic data retention. Discuss experiences and pain points with the current records management and recovery strategy. Also use this opportunity to explain the technical and operational aspects of data archiving solutions so users will have realistic expectations once the system is operational. Another question to answer is whether the corporate culture is to save more or save less data. Litigation and compliance may discourage deletion of data, but other priorities may outweigh this risk. For example, as an archive grows larger it requires greater human management as well as increasing amounts of storage.
Page 6 of 15
These factors may prove too costly, requiring data to be purged. No deletion should occur without a policy to fall back on. Once a variety of opinions and requirements has been obtained, clearly outline these in technical and business terms. Categorize risks in terms of security, compliance, e-discovery, and productivity and determine the ways in which an archiving solution can be used to help. Also consider the operational impacts of the archiving solution, which could include increased productivity, improved storage management, and cost reduction. Having a clear list of needs and objectives will assist in the solutions selection, implementation, and operation and will increase the likelihood of the projects success and overall satisfaction.
Email Archive and Search Case Study A Large Engineering Service Provider Profile: A large integrated engineering service provider was facing difficulties responding to legal requests to locate data. In addition, their ever increasing volume of e-mail traffic was becoming difficult and time consuming to manage. IT Challenge: The company required an automated archiving solution to meet multiple business drivers. The solution requirements included an e-mail archive capable of advanced search features for e-discovery requests, mailbox management to improve operational efficiencies and record retention features that could be used to enforce policy compliance. After an extensive search for a service provider, Quest Software was selected to provide an e-mail archive solution with Archive Manager. Solution: Quests Archive Manager provided users immediate access to information from any machine in any location and single-instance storage ensured maximum storage efficiencies. With no client software to install, all e-mail messages sent and received were captured and the installation and configuration were complete in three days. The ease of installation reduced the cost and complexity of implementation. Results: Archive Manager is providing benefits across the entire organization, improving email storage management, server performance, and allowing greater accessibility to messages. The improved search capabilities have reduced e-discovery requests from several months to days, and maintaining good corporate governance is now easily manageable.
3. Consider Search and Tagging Requirements One of the key benefits of an archiving solution is its ability to quickly search through a wide variety of data. Searching is enabled by the use of data indexes and is enhanced with automated tagging and free-form commenting capabilities. Not all solutions offer the same tagging and search capabilities, however, with different levels of automation and flexibility becoming common product differentiators. Some e-mail archiving solutions allow tight integration with applications, such as providing a view of the archive that is integrated with normal use of the system. Others require the use of an unfamiliar application or data structure such as a
Copyright 2007 Contoural, Inc Page 7 of 15
separate user interface to browse, search, and recover information from the archive. Consider the level to which interactive browsing, searching, or automated data tagging will be required by your users and select an application with capabilities to match. If a proprietary interface is used for searching, weigh the amount of training that will be required to get your users up to speed. E-discovery in particular requires flexible and dynamic search and tagging capabilities. Legal requests for every e-mail related to this customer or every file containing this keyword are common as litigation progresses. An archiving system that tags messages or files based on criteria like customer names would be appropriate for the former request, while one that allows ad hoc queries will be required for the latter. If e-discovery is a requirement for your archiving solution, look for one with robust capabilities in this area. 4. Automate the Archiving Process Employees do not have the time or expertise to manually classify and manage records. A manual process inevitably leads to an incomplete and inconsistent archive. Automated archiving will ensure a uniform archiving process and increase end user productivity. In addition, most archives ensure record protection if a litigation hold is issued. Any archiving solution professing to serve the needs of regulators or litigators must contain a complete set of information. An automated archiving solution is only as good as the rules it is following, but an enterprise-wide solution is preferable to a fragmented archive. Since many archiving solutions are tailored to specific applications or data types, focus on applications for which technical archiving solutions are already available and invite widespread use. Examples include e-mail, document management, CRM and other databases, and file servers. Some archiving solutions support multiple data types, but there is no general purpose archiving solution for all data. Therefore, any archiving solution will be limited by definition, but an automated solution will provide a more complete data set. Consider also the security implications of data retention. Any data that is saved will be subject to a variety of privacy regulations, so any solution must be secure. Data security includes three primary facets: confidentiality, integrity, and availability. Automated software solutions are likely to excel in all three areas when compared to human processes. 5. Start Archiving Now and Backfill Over Time Implementation of an archiving system need not wait for the complex and time consuming task of creating of an overall data retention policy. In fact, it is often simpler to start collecting data from all supported sources immediately rather than trying to create a perfect system and delaying implementation. Select an archiving solution compatible with the companys existing e-mail system, file
Copyright 2007 Contoural, Inc Page 8 of 15
server, or database and begin archiving data without committing to any deletion schedule. Even the most aggressive deletion policy would leave IT with a year or more before needing to delete anything. An archive cannot be considered fully functional until it has run long enough to have a complete set of records for the specified retention period. For example, if a company decides to retain all e-mail for a period of five years, it would take that long for the e-mail archive to fill. By proactively implementing e-mail archiving, the organization will be better able to handle legal or regulatory problems should they occur over the next few years. Whether or not to import other data sources is an important consideration. Although it will certainly be tempting to fill the archive with the content of backups, PSTs, online datasets, and previous manual archives, this process opens the door to duplication and inconsistency. Consider whether the benefit of a more comprehensive archive is worth the risk of having gaps and inconsistencies. It can be particularly difficult to locate historic data on crowded unstructured file servers. While implementing archiving, many organizations will simultaneously begin assessing their unstructured storage, especially network file servers. Storage resource management (SRM) applications can help here, locating all files of a certain type across many different servers. In the case of Microsoft Exchange archiving, an SRM tool can locate all PST files stored on network file servers. These can then be integrated into the archive if desired. 6. Use Reporting Features to Improve Efficiency and Effectiveness Once the archive is running, implement regular monitoring and reporting processes to ensure the maximum benefit is being obtained. Check storage capacity well ahead of time, since archiving inputs cannot wait while excess capacity is procured. Regular capacity reports will also enable a greater understanding of the volume of data being imported into the archive, potentially directing future efficiency projects. Use the capacity reports to develop forecasts for system utilization as well as operational considerations. As the volume of data in the archive increases, so will the amount of human effort required to manage it. A long-term progression of operational reports will ensure that staff can be brought in when needed. The second major area to monitor is compliance. Generate reports to show that the archive is performing as expected, and share these with the stakeholders identified previously. If any unexpected results or failures appear, share these as well since stakeholder buy-in will be needed to support remediation plans. Demonstrating the success and stability of the archive will encourage users to put faith in the solution rather than building disparate archives, which undermines policy.
Page 9 of 15
7. Retention Periods: Make it Simple Some organizations have retention schedules running several hundred pages in length. While these types of retention schedules receive high marks for completeness, they are nearly impossible to implement and monitor for compliance. Contoural recommends using a fairly simple record retention methodology. By moving toward broader categories and fewer retention periods, the need to identify the precise retention periods for every record type is reduced. It also simplifies implementation with automation, and improves actual good-faith compliance with the policy. Legal research and review can then focus, reasonably, on the record types and jurisdictions that represent the highest levels of risk or cost. Start with a few simple retention periods, such as one year, five years, ten years, and indefinite. Match these timeframes to record-type requirements, making sure that minimal needs are met. For example, as a broad category, HR records for employee files should be kept for six years. As a broad record category, assign it to the ten year retention pool even if some of the employee files or files in other regional locations have shorter retention periods. The idea is to set a retention baseline for broad record categories worldwide. 8. Retention Periods: Exceptions as Needed While the majority of record retention can be automated, a global firm will still need to make provisions to accommodate local or country-specific requirements for exceptions. Some of those exception conditions might involve retention periods (e.g., permanent or "indefinite"); media (e.g., some record types must be kept in paper form); or location (e.g., records in this category cannot be moved outside the country's borders). Other exceptions a company might need to address include country-specific variations. For instance, some countries might require that all HR records be kept indefinitely. Forcing the global retention schedule to meet the most extreme requirements does not make sense, especially if the retention periods would require migrating large amounts of very old data across multiple generations of technology platforms, logical formats and physical media. How should these exceptions be handled? Employees need to be educated on how to recognize the exceptions and how manage them. For example, if an employee receives an e-mail containing information that needs to be retained for a longer period, the employee could: 1) Print the e-mail and save the paper record for the appropriate retention period or 2) Copy the contents of the e-mail into a Word file that will be saved for the appropriate retention period.
Page 10 of 15
Enterprise Archive Case Study A Large Healthcare Provider in the UK Profile: A large, grant-aided organization provides healthcare and assisted living services, housed in a historic tourist attraction with an extensive museum and historical archive. IT Challenge: The organization is subject to data protection and compliancy and thus required an automated archiving solution to address three specific business drivers. First, as a charitable organization, the organization must meet national requirements. Second, as a healthcare provider, the organization is subject to rapidly evolving regulatory requirements. And finally, being a Crown body, IT functions must conform to strict standards. In addition, the organizations historical data must be protected for the ages. Solution: Quests Archive Manager coupled with BridgeHead Softwares HT FileStore was chosen as the best solution for managing and securing data. This data repository managed by HT FileStore provided Archive Manager with a robust multi-copy, multi-location archive that automatically accommodated the long-term secondary storage needs of the virtual archive. To ensure high-availability of the archive, a dual-copy archive was deployed using NetApp NAS systems. The initial e-mail archive project was expanded to include back up and recovery capabilities as well as backfilling the archive with general unstructured data to include essentially all company data. Automated polices to identify general files were secured in the dual-NAS repository with the option to remove or stub those files in order to conserve primary disk space. Results: The solution is protecting and compliantly retaining e-mail and other data. The organization has achieved operational efficiencies for finding and analyzing information and by minimizing the need for expensive primary storage. Furthermore, the archive provides access controls and auditing capabilities essential for compliant archiving.
9. Employee Education & Training Most employees do not know if their company has a record retention policy or schedule much less where to find it if needed. To help ensure compliance with the policy and schedule, employees, managers and any assigned departmental records coordinators should be educated on the record retention policies and procedures. While the use of stubbing makes many archiving solutions user friendly, employees should also be trained on the automated archiving solution. Create a training plan and develop the necessary communication tools for training various levels of employees. Policy audit processes and procedures should also be developed. General elements of an employee education and training plan should include: 1. Training materials for new and existing employees. Training can be delivered in a variety of formats including classroom settings, on-line, or through webinars. 2. Audit records to show that policies have been read and understood and include employee acknowledgement forms. 3. Easy access to the policy and schedule on the corporate intranet.
Page 11 of 15
10. Define or Update a Record Retention Policy and Schedule A data retention policy should cover all employees, contractors, and others related to the company who create, send or receive, or use e-mail messages and other data files. The policy should manage the retention, storage, and disposition of business records, whether they are in paper, electronic or other formats or media, in a manner consistent with applicable laws and regulations. It should be understood that all computer data is covered, including e-mail messages (semi-structured), business documents (unstructured), and application data (structured). As the archiving system is implemented, issues may crop up regarding the current record retention policy and schedule. Once an updated policy is in place, be sure to review it annually. Regulations and laws are constantly changing and the courts expect companies to be fully aware and prepared. A policy should include the following standards: 1. Definition of a business record 2. Security and data privacy issues 3. Data management and retention policies 4. Staff responsibilities 5. Auditing and processes for dealing with violations A record retention schedule shows record-type names and retention periods for most of the documents a company prepares in the regular course of its business. Specified retention periods are based on the following criteria: 1. Business needs for retaining the records; and 2. Specific provisions in applicable laws and regulations that require the company to maintain certain records
Page 12 of 15
Conclusion
The explosion of electronically stored information and e-mail, in particular, has caused increased pressure on the IT organization to manage the data. Using an automated archive solution offers companies a way to capture a variety of data types and mange the data for compliance and litigation readiness. These 10 best practices should enable IT to plan, evaluate and implement an enterprise archiving solution.
Page 13 of 15
About the Author - Stephen Foskett

Stephen Foskett is Director of Contoural's Data Practice. This group provides strategic consulting to Fortune 500 companies which assist enterprise customers in aligning their storage and computing infrastructures with their business objectives. Foskett has provided vendor-independent end user consulting on storage topics for over 10 years, including work managing and delivering consulting services at GlassHouse Technologies, StorageNetworks, and Sprint Paranet. He has been a storage columnist and has authored numerous articles for industry publications, and is a popular presenter at industry events.
About Contoural, Inc.

Contoural is a leading independent provider of business and technology consulting services focused on litigation readiness, compliance, information and records management, and data-storage strategy. Contoural helps clients address the business requirements emerging around data. For example, electronic discovery rulesunder the new Federal Rules of Civil Procedurenow require US companies entering litigation to know what electronically stored information they have, where the ESI is stored, and how quickly they can retrieve that ESI. Similar issues and requirements affect business records in many countries worldwide. Similarly, legal and regulatory compliance requirements under emerging privacy laws are motivating enterprises to take a closer look at the integrity and security of electronic document files and other digital data. Contoural helps clients understand the business requirements for managing records, and then assists clients to align these business needs with their IT strategies and storage spending. These services bridge the gap between applications and data storage. Contoural services include:
Records-retention policy development Litigation-discovery process improvement Data classification and storage strategy Data archiving solution design Contoural, Inc. 1935 Landings Drive Mountain View, CA 94043 650-390-0800 www.Contoural.com info@contoural.com
With these services, Contoural helps enterprises ensure compliance and reduce risks, while also achieving litigation readiness and reducing costs.
Page 14 of 15
About Quest Software, Inc.

Quest Software, Inc. delivers innovative products that help organizations get more performance and productivity from their applications, databases and Windows infrastructure. Through a deep expertise in IT operations and a continued focus on what works best, Quest helps more than 50,000 customers worldwide meet higher expectations for enterprise IT. Quests Windows Management solutions simplify, automate and secure Active Directory, Exchange, SharePoint and Windows, as well as integrate Unix, Linux and Java into the managed environment. Quest Software can be found in offices around the globe and at www.quest.com.
Page 15 of 15

10 Best Practices For Archiving: A White Paper, Sponsored by Quest Software

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

10 Best Practices For Archiving: A White Paper, Sponsored by Quest Software

Uploaded by

Copyright:

Available Formats

10 Best Practices for Archiving

A White Paper, Sponsored by Quest Software

Copyright 2007 Contoural, Inc.

10 Best Practices of Archiving Whitepaper

Copyright 2007 Contoural, Inc

10 Best Practices of Archiving Whitepaper

Copyright 2007 Contoural, Inc

10 Best Practices of Archiving Whitepaper

Copyright 2007 Contoural, Inc

10 Best Practices of Archiving Whitepaper

Copyright 2007 Contoural, Inc

10 Best Practices of Archiving Whitepaper