Courts have indicated in past actions that penalties for failure to comply could be harsh ' and costly. Even before the rules were recommended, Morgan Stanley was fined US$1.5 billion -- half of which was punitive -- in May 2005 when a judge ruled that it had failed to preserve information.

Of the Computerworld survey respondents, 15 percent said their company was halfway or somewhat prepared, while 5 percent said their company was completely prepared. Twenty-two percent said they had prepared for the new rules by reading about them, and a few said they had retained inside or outside counsel to prepare. A number of respondents also said this was the first time they had heard of the new rules.

Don Green, manager of accounting and information systems at Texas Aromatics LP, a petrochemical company in Houston, said he had not even been aware of the rules changes before receiving the Computerworld survey, but he said he was going to speak to his outside legal firm to determine what the firm needed to do.

Jack McLaine, assistant vice president of MIS for Leesport Financial Corp., a Reading, Pa.-based insurance, investment and retail company, said the firm began taking steps to meet the rules a year and a half ago ' before the new recommendations had even officially been made. "We knew it was coming," he said. "We couldn't say, 'We'll do it next year.' We said, 'We've got to do this now.'"

Leesport spent $60,000 to set up an email archiving system, including document scanning, based on the Dynamic Information Services product from Permabit Inc., in Cambridge, Mass., he said. Since then, he has added redundancy and failover capabilities as well.