Unlike Sarb-Ox and HIPAA, which focus on subsets of an organization's activities and primarily on specific vertical industries, FRCP covers everything that could potentially be part of a federal civil suit or tort claim, which means everything in an organization.

Over the last several years, the FRCP committee at the U.S. Department of Justice has conducted a thorough update of the rules in light of the shift in business from paper to electronic communications and records. E-mail was a major focus of this review, says Brian Babineau, analyst at Enterprise Strategy Group Inc., "because people will say anything in an e-mail."

In 2005, "77 percent of organizations that went through an electronic discovery event had to produce e-mail," he says. And that percentage will only grow over the next few years. Because e-mail production is new in civil cases, however, it raises a number of key questions than the rules changes attempt to answer, among them:

-- What needs to be produced in response to a request?

-- What format does in have to be in?