In contrast to other application data categories, e-mail is relatively straightforward. It is dominated by a couple of applications (Exchange and Domino), and its data formats are well understood. Thus, it has been possible for a variety of third parties to develop tools to archive e-mail in an automated, policy-driven manner. In fact, an e-mail archive can be viewed as a special-purpose data warehouse, and one of the primary duties of an e-mail archiving application is to perform the ETL (extract, transform, load) function. Once in the repository it is easy to apply appropriate retention policies and perform searches for e-discovery as well as other kinds of analysis (e.g. questionable use).

Unfortunately, for many of us, an e-mail archiving application can't set policies. It can implement and enforce them, but ultimately the tool is only as good as the policies applied to it. This is where many organizations fall short. Best practices demand that regulatory and business requirements are the primary drivers for data management policies. However, GlassHouse Technologies Inc. recently conducted a survey on e-mail archiving and found that in a surprising number of organizations, this is not the case. As the chart below shows, in 65 percent of the 100-plus companies surveyed, IT was the primary decision maker for e-mail retention policy.

So what are the policies that are being established? As you may suspect, they are not necessarily the ones that would make legal or compliance sleep well at night. As shown in Figure 2, the survey found that significant number of organizations either have no defined policy or are applying a "one size fits all" approach to e-mail. This is very risky or very inefficient -- or both.

Determining e-mail policy is not a simple matter. Regulations demand that certain types of business records be maintained for specified periods of time, so a couple of key questions should be: "Is e-mail a business record?" and "Which e-mail?" Even more serious for many companies is the legal exposure presented when e-mail is retained for long periods with no business justification. However, there is also the issue of company culture: for many people, e-mail also serves as a knowledge base. The impact of losing this valuable source of information must also be weighed.