Top 5 email retention policy best practices

Email retention policies are no longer just about conserving space on your Exchange server. Today you must take into account how your email retention controls increase or decrease risk to your company.

Pros and cons of short and long email retention policies

Generally speaking, longer email retention policies increase the risk that a security vulnerability or unauthorized user could expose your company's secrets or embarrassing material. Long policies also increase your company's exposure to legal examination that focuses on conversations and decisions captured in emails (this is also known as the "paper trail" in an "eDiscovery" process).

Shorter email retention policies help avoid these problems and are cheaper to implement, but they have their own significant disadvantages as well. First, short policies tend to annoy long-term employees and often executives, who rely on old email chains to recollect past decisions and the context in which they were made. Second, short policies may violate federal, state, local and/or industry regulations that require certain types of information to be retained for a minimum period of time - often years!

Best practices to develop your email retention policy

Obviously, you must balance these factors and others when you develop your own email retention policy, but there are a number of best practices that can help you draft and get support for a solid email retention policy. Today, I'll be covering five practices often used by effective professionals and managers.

Email retention policy best practice #1: Start with regulatory minimums

Your email retention policy should begin by listing the various regulations your company is subject to and the relevant document retention requirements involved with each regulation.

Every industry is regulated differently, and businesses are often subject to different tax, liability and privacy regulations depending on the locations in which they do business. However, some common recommended retention periods include:

• Internal Revenue Service (US IRS): seven (7) years
• Payment Card (PCI DSS): one (1) year
• California Franchise Tax Board (CA FTB): four (4) years
• DISA Security Technical Implementation Guides (STIG): one (1) year
• Many State Revenue Departments: three (3) years
• HIPAA Section 164: six (6) years

If a retention period is not known for a particular type of data, seven years (the minimum IRS recommendation) is often used as a safe common denominator.

Email retention policy best practice #2: Segment as necessary to avoid keeping everything for the legal maximum

As you can see from the list above, recommended retention periods vary widely even within highly regulated industries. With that in mind, it often pays to segment different types or uses of email into different retention periods to avoid subjecting your entire online email store to the maximum email retention period.

Segmentation by type of content looks something like this:

• Invoices - 7 years
• Sales Records - 5 years
• Petty Cash Vouchers - 3 years

Segmentation by type of use looks something like this:

• Administrative correspondence (e.g., human resources) - 5 years
• Fiscal correspondence (e.g., revenue and expenses) - 4 years
• General correspondence (e.g., customer interactions, internal threads) - 3 years
• Ephemeral correspondence (e.g., everything else business-related) - 1 year
• Spam - not retained

Mixed segmentation is also often common and looks something like this:

• Human resources - 7 years
• Transaction receipts - 3 years
• Executive email - 2 years
• Spam - not retained
• Everything else (e.g., "default retention policy") - 1 year

The rules and technologies you use to inspect, classify and segment can vary from simple sender- and subject-matching to sophisticated engines that intuit intent and history. (Unfortunately, space does not permit us to examine these technologies here, but trust me - they exist!)

Email retention policy best practice #3:Draft a real policy...but don't include what you won't enforce

A written policy, approved by legal counsel and senior management, will give you the requirements and authority to implement all the IT, security and process controls you need. If you haven't seen a full retention policy yet, please take the time to search the web for a few.

Note that many "email retention policy" documents cover much more than email! In general, this is OK because a "document policy" gives you what you need to implement an "email policy", but you'll want to make a point of talking the "document vs. email" terminology through with your legal team before you finalize your policy.

A good written policy always contains these sections:

• Purpose: why does this policy exist? If specific regulations informed the creation of this policy, they should all be listed here.
• Retention time, by segment: how long various types of content or content used in a particular manner must be retained . Durations are often listed in years, may include triggers (e.g., "after X") and may even be "Permanent".
• Differences between "paper" and "electronic" documents: ideally, none.
• What constitutes "destruction": usually shredding and deleting, often "secure deletion" (e.g., with overwriting) and degaussing of media where applicable.
• Pause destruction if legal action imminent: your legal department will normally add this for you, but you can show off your legal bona fides by including a clause instructing IT to pause automatic email deletion if the company becomes the subject of a claim or lawsuit (this is also called a "litigation hold").
• Who is responsible: typically everyone who touches the documents, often with special roles for certain titles (e.g., "Chief Archivist") or groups (e.g., "legal counsel").

Good written policies omit areas that you won't or can't support, especially types of segmentation you will not be able to determine or support. Good policies also refer to capabilities and requirements (e.g., offsite archival) rather than specific technologies and processes (e.g., DAT with daily courier shipments).

Email Retention Policy Best Practice #4: Price Preferred Solution and Alternatives By Duration and Segment

Let's pretend that you have a policy like the following:

• All email: retain on fast storage for 18 months
• Purchase transaction emails : also archive to offline storage until 5 years have passed
• Legal emails: also archive to offline storage until 7 years have passed
• "Fast storage" = accessible through end user's email clients through "folders"; normally only individual users can access, but administrators and archival specialists (e.g., the legal team) can access too
• "Offline storage" = accessible through internal utility and search; only administrators and archival specialists (e.g., the legal team) can access

To price an appropriate solution, you would restate your requirements based on number of users, expected volume of email and expected rate of growth. For example, in a 500-person company where each user averaged 1MB and 100 messages of email a day, there were 5000 additional transaction emails (total 50MB) a day and 100 additional legal emails (total 20MB) a day, and volumes were expected to increase 10% per year, here's how we might estimate minimum requirements for the next seven years:

• All email: 18 months x 1MB/day-person x 30 days/month x 500 people = 270GB x 1.8 (about 10% increase in 6 years) = 486GB email server storage
• Purchase transaction emails: 5 years x 12 months/year x 30 days/month x 50MB/day = 90GB x 1.8 = 162GB email archive storage
• Legal emails: 7 years x 12 months/year x 30 days/month x 20MB/day = 50GB x 1.8 = 91GB email archive storage
• TOTAL: 486GB server + 253GB archive

However, after you've priced out your preferred solution, you still need to be prepared to handle alternatives that may result from discussions with legal or your executive team. For example, if the executive team pushes your 18 month blanket retention to 3 years and the legal team "requires" that its emails are always in near-term email storage, how would that change your requirements and pricing?

• All email: 36 months x 1MB/day-person x 30 days/month x 500 people = 540GB x 1.8 (about 10% increase in 6 years) = 972GB email server storage
• Purchase transaction emails: 5 years x 12 months/year x 30 days/month x 50MB/day = 90GB x 1.8 = 162GB email archive storage
• Legal emails: 7 years x 12 months/year x 30 days/month x 20MB/day = 50GB x 1.8 = 91GB email server storage
• TOTAL: 1063GB server + 192GB archive (e.g., DOUBLE your realtime storage!)

Long story short, if you can figure out your own rule-of-thumb per-GB price for the various types of storage necessary to support your archiving scheme (as well as licensing considerations, including any per-message or per-type-of-message rules) you'll be better prepared for "horse trading" later in the approval process.

Email retention policy best practice #5: Once you draft your policy, include legal before the executives

If you're still reading this, chances are good that you (like me) are a senior IT or security professional, or are perhaps even a manager. If you've drafted other IT policies, such as an "acceptable use" policy, your first instinct might be to keep your legal team out of the process until your new policy has snowballed down from your IT-based executive sponsor. This is almost always a mistake.

The main reason legal should be included as soon as you have a draft is that two of the best practices listed above (regulatory minimums and viability of segmentation) are really legal's call - not yours! You will have saved legal a lot of legwork by researching the main drivers of email retention policy and the technical controls you can use to enforce the policy, but at the end of the day legal will be called upon to defend the company's decision to keep or toss critical information, so legal will need to assign the final values to your policy limits.

A second reason to include legal before your executives is that you want to present a unified front (as IT and legal) on your maximum retention limits. Once you get into negotiations with your executive team, legal will likely be pushing for even shorter limits (because it limits the threat of hostile eDiscovery) and the executives will be pushing for even longer limits (because email is their old document storage). This puts you (as IT) in the rational middle and gives your policy a good chance of making it through the negotiations relatively unscathed.

The final reason you want to include legal early is that their calls may force you to reprice the options you laid out before you talked to them, and may cause you to take some options off the table. If you reversed the process and got executives to sign off on a solution that got vetoed by legal and sent back to the executive team for a second round of "ask," I think you know that no one would be happy.

Conclusion: Your email retention policy will be your own

Given all the different constraints your organization faces and all the different ways your interactions with your legal and executive team could go, it would be impossible for me to predict what any company's email retention policy would be. However, if you follow these five best practices when you develop your own, you stand a better-than-average chance of drafting an email retention policy that's sensible, enforceable, and loved by legal and top management alike.