Educause Security Discussion mailing list archives

Re: archiving email


From: Terence Ma <Terence.Ma () TUN TOURO EDU>
Date: Thu, 16 Jul 2009 15:53:48 -0700

We have selected a device as our automatic archival machine. Since we are relatively small and will be looking to 
retain only email through the official University Exchange server (faculty/staff only), we should be okay. 
Specifically, we are looking at the Barracuda Message Archiver series (for our campus, a Model 650 looks to be more 
than adequate).

Because our University is primarily a health care University and we have had a number of questions and issues that go 
back three to four years, our electronic data retention policy (adopted this morning) requires that I retain all 
inbound and outbound email for five years. We will be implementing this policy as soon as we receive our device.

We have a task force working on the issue of paper retention as well as on paper-to-electronic retention.

Best, Tere

--
Terence P. Ma, Ph.D.
Chief Information Officer
Touro University Nevada
874 American Pacific Drive
Henderson, Nevada 89014, USA
Ph: 702-777-1805
Mb: 702-469-1770
Fx: 702-777-1736
Em: terence.ma () tun touro edu

-----Original Message-----
From: The EDUCAUSE Security Constituent Group Listserv [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Zach 
Jansen
Sent: Thursday, July 16, 2009 1:09 PM
To: SECURITY () LISTSERV EDUCAUSE EDU
Subject: Re: [SECURITY] archiving email

I am curious about this as well since I've been looking at this again recently. I looked at several school policies 
that are available via google: "site:.edu email retention policy"

In general what I saw were retention periods ranging from 180 days to 4 years. Public institutions had the longer 
periods as they sometimes had state public records retention requirements. Seemed like the private institutions favored 
the shorter retention periods. A few sites broke their email down into classifications such as administrative, fiscal, 
general, or ephemeral

The other part I was interested in was the mechanism for retention. In the cases I saw, the user is expected to 
manually implement the retention of the documents, usually by archiving documents, printing documents, or sending them 
to a retention email address. I didn't see any indication that schools were implementing systems to automatically 
retain all records for a period of time (I saw one or two schools that seemed to be automatically deleting anything not 
archived after the retention period) or based on other criteria such as keywords. To me it seems like relying on users 
to archive messages that may be relevant for litigation may be a weak spot in a retention plan. Once notice of legal 
action is received this seems easier to deal with, and I've seen a few response plans indicate the need to image/copy 
machines, email, etc when notice is received. Is the manual nature of retention a concern that others have with their 
email retention policies?

The other part I wondered about is, once a document is archived or printed, what is the retention period for those 
documents? I didn't see any indication of how that's being handled. I know that here, when people archive an email 
message, it's probably going to stay in the archive forever or until their storage is full. In my mind that would 
violate a records retention policy that states email should only be kept for X days or years when some of it is 
archived and kept for longer than the retention period.


Anyone have any advice on these issues?

Thanks,

Zach Jansen


-- 

Zach Jansen
Information Security Officer
Calvin College
Phone: 616.526.6776
Fax: 616.526.8550

On 7/16/2009 at 10:29 AM, in message
<66CA77B6F1A6AE44B6EC941464FFB31C611A481C8E () EXCHCLUSTER scc stchas edu>,
Barbara Keim <bkeim () STCHAS EDU> wrote:
We are developing a policy related to archiving college email including how 
long to store the information in case it is needed in the future for a legal 
discovery process.

Could you please share samples of your policies including how long you are 
saving emails.

Thank you.

Best regards,


Barbara Keim, Ph.D.
VP  Technology, Research, and Planning
St. Charles Community College
St. Peters, MO  63011
636-922-8573


P Please consider the environment before printing this e-mail.

Current thread: