An Overview of Group Wise and Records Retention

An Overview of Group. Wise and Records Retention Lindsey Johnstone System Manager to the City Council City of Seattle lindsey. johnstone@seattle. gov ®

The one Net vision 2 © March 9, 2004 Novell Inc.

The one Net vision 3 © March 9, 2004 Novell Inc.

Why Be Concerned? Storage • The average user will attempt to retain/store 500 MB of messages per year (+1. 5 TB of storage/year for 11, 000 users) Volume • IDC projects 33 billion messages per day in 2005, up from 23 billion MPD today Cost • • 4 $1. 6 mil to archive/restore messages for an organization with 8000, exceeds entire HD budget. White House spent $10 M to recover 246 K messages from 4, 900 backup tapes… © March 9, 2004 Novell Inc.

Why Be Concerned? Knowledge • IDC Reports that 60% of business critical information is stored in messaging systems Access • 80% of archived data is either unprotected or inaccessible • Critical information is routinely destroyed or lost Productivity • 5 Can you afford to burden users with the time overhead of mail management? © March 9, 2004 Novell Inc.

Strategy Needs to include consideration of some or all of the following: • • Post office settings • Messaging policies • Hardware needs • Message flow • Storage method • Storage management • 6 Local, state, or federal laws regarding citizen access Retrieval process © March 9, 2004 Novell Inc.

Strategy (cont. ) Local, state, or federal laws regarding citizen access • • Different retention schedules depending on position • Length of time required to retain • 7 Varies as to what is retainable Tiered access - HIPAA © March 9, 2004 Novell Inc.

Strategy (cont. ) Verticals covered today • • Financial Legal Health & Medical Government Agencies Utilities Defense Consumer goods Verticals covered tomorrow • 8 Any business process, in any organization, where records management has traditionally been applied to paper © March 9, 2004 Novell Inc.

Policy Messaging policies • • Retention schedule (45/7/120) • Legal requirements • © March 9, 2004 Novell Inc. Personal use policies • 9 Who owns the information? Resource management

Policy Review Federal, State and Municipal Guidelines and Statutes to validate applicability Align with current Document Policies Define Mail Usage Policies • • 10 © March 9, 2004 Novell Inc. No policy equates to multiple individual policies Encourage Positive Behavioral Change

Policy • • Securities and Exchange Commission • Food and Drug Administration Policy • HIPAA • NARA GRS 20 (Federal US) • © March 9, 2004 Novell Inc. The Freedom of Information Act • 11 ISO 17799 (standard for information security management) DOD 5015. 2 Design criteria standard for electronic records management software applications

Policy Legal • • • Discovery Harassment Disclosure & Expected Lack of Privacy • ECPA (Electronic Communications Privacy Act) Security • • Organization’s Internet Policy Contrast to Physical Security – Open Accounts Resources • • • 12 © March 9, 2004 Novell Inc. Bandwidth Storage Personnel Costs

Policy • All e-mails to be preserved: • • • For a period of not less than six years, First two years in an easily accessible place E-mails to be archived: • On non-rewriteable, non-erasable formats • where the quality and accuracy of the archiving process can be automatically verified • • 13 Provide full audits of the archive environment Ability to review both inbound and outbound e-mail content © March 9, 2004 Novell Inc.

Policy Why is retention required? • • Support for potential litigation Internal workflow Knowledge Management Historical record Some Sobering Facts (CNI 2001) • • • 14 34% of Organizations could not recover e-mails Recovery costs too high to justify ongoing litigation, settlement is only option Almost half of all users routinely ignore policies © March 9, 2004 Novell Inc.

Policy Destruction & Duplication • Processes should be in place to ensure that these messages are removed from the message store to avoid the potential of conflict. Consider copied messages on laptops, PDA’s & home systems Think long term • 15 Messages may have to be stored and retrieved long after Group. Wise®, Net. Ware® and the hardware obsolete. Media may also degrade or become obsolete – plan periodical migration of archived data © March 9, 2004 Novell Inc.

Storage Management Large Volume of Messages – Overwhelming Amount of Information • • • CNI Reports Average 70 Messages /day (200 a day for elected officials) Loss of User productivity to deal with it Impact on internal systems and software Messaging Growth Rates – – New services (UM & VOIP) will increase mailbox storage requirements – 16 Volumes increasing annually at 33% Limiting Mailbox Sizes is not really a long term option. © March 9, 2004 Novell Inc.

Storage Management Disk Space is Cheap. . . • • Performance degradation • Higher Data Integrity Risks • © March 9, 2004 Novell Inc. Additional hardware (tape backup) • 17 Increased management costs Impact to Disaster Recovery

Storage Management Large Message Stores • • • Increased potential for message corruption Access and Performance Issues Increased Administrative Costs • • Hardware Costs • • • 18 14 -16 Hours/week e-mail backup and recovery 6 Hours / week recovering e-mails from tape 25% of time on retention management Over the next 5 years, expect a 6 fold decrease in the $/TB, but a 100 fold increase in data. The net result is a projected 13 fold increase in total storage mgmt costs Disaster Recovery Impact © March 9, 2004 Novell Inc.

Storage Management Content • All Messages or Public Record Messages? • Regulatory Compliancy? • Internal/External or External Messages? • Attachments, copies, links • • 19 Message, Date Information, Delivery Information, Distribution & Addressing Lists Mail, Appointments, Tasks, Notes, Phone Messages, Personal Items, Address Books © March 9, 2004 Novell Inc.

Accessibility • • Access from External Applications • What information? • Who has access? • 20 Access to information from Group. Wise Required Security? © March 9, 2004 Novell Inc.

Destruction Data Retention & Destruction Guidelines • Legislation, compliance, policy • Message Tagging & Classification • Fundamental to destruction • Transitory messages? (Friday afternoon notices of cleaning out the refrigerator) • Destruction Authorization? • Physical Destruction criteria • 21 © March 9, 2004 Novell Inc. Online records, backed up records

Regulations & Guidelines Do. D 5015. 2 -STD • Design Criteria Standard for Electronic Records Management Software Applications • • Defines Metadata Structures for Classifying Physical and Electronic Documents • 22 Defines Functional Components of a Records Management Application Requires User Classifications Processes © March 9, 2004 Novell Inc.

Regulations & Guidelines Mandatory Metadata Record Fields • Record Category Name • Record Category Identifier • Record Category Description • Disposition Instructions • Disposition Authority • Permanent Record Indicator • Vital Record Review Cycle …Plus Metadata Folder Fields 23 © March 9, 2004 Novell Inc.

Regulations & Guidelines Secretary of State –Washington State • Guidelines for Developing Policy and Establishing Procedures for E-Mail • Differentiates Public & Transitory Messages • Advises on creation of E-mail Policies • Advocates destruction of transitory messages (executive order 00 -30 Public Records Privacy Protection) http: //www. secstate. wa. gov/archives/gs. aspx 24 © March 9, 2004 Novell Inc.

Challenges • • Storage • Retrieval process • Collaboration • Participation • © March 9, 2004 Novell Inc. Enforcement • 25 Version changing Novell Group. Wise®

Challenges • (cont. ) Version changing • • 26 © March 9, 2004 Novell Inc. If the software is updated, does it allow backwards compatibility? If you change systems, can you still access the “old” information?

Challenges • (cont. ) Enforcement • Who’s in charge? • Who polices the process? • • Do all stakeholders understand the need to comply? • • © March 9, 2004 Novell Inc. Implications if they don’t Are the policies stated clearly and enforceable? • 27 Backup Beware unreasonable expectations

Challenges • (cont. ) Storage • Server-based • • CD • • © March 9, 2004 Novell Inc. Integration seamless? Paper • 28 Does it meet standards? Emulation or transfer software • • Budget Space

Challenges • (cont. ) Retrieval process • • © March 9, 2004 Novell Inc. Is it easy to use and timely? • 29 What is the process for requesting records What retained records will be available, and to whom, and when?

Challenges • (cont. ) Collaboration • • Microsoft Excel • Microsoft Access • Corel Word. Perfect • © March 9, 2004 Novell Inc. Microsoft Word • 30 What dependent externals are involved? Web

Challenges • (cont. ) Participation • • How available is the information? • By request • Web-based • © March 9, 2004 Novell Inc. Is there citizen involvement with the planning, administration or oversight of the process? • 31 Are all stakeholders “on board” with the plan? Terminal-based

Challenges • (cont. ) Group. Wise • Encryption • • Process • • © March 9, 2004 Novell Inc. What matrix do you employ to separate retainables Education • 32 Need a client to de-encrypt Easy, if relying on a third party product

Challenges • (cont. ) Whoops • Recovery process • • Disaster recovery policies Training • • • New employee training Retraining and monitoring Backup • 33 © March 9, 2004 Novell Inc. Robust enough?

Where Do We Go from Here? The Goal A completely invisible to the end user, comprehensive mechanism to record all retainable emails, both external and internal, with message flow tracking contained in a database environment that would allow for extensive subject and message text searching and filtering. Additionally, provide a method of extraction that would be readily accessible and allow for Internet access of the records. http: //www. novell. com/coolsolutions/gov/features/a_lindsey_j_record_retention_gov. html 34 © March 9, 2004 Novell Inc.

Links – Comprehensive Products http: //www. nexic. com/discovery/index. html Discovery Suite http: //www. gmb. com. au/Products/gem. htm GEM http: //www. intellireach. com/products/message_archive. htm Archive. Manager for Group. Wise 35 © March 9, 2004 Novell Inc.

Links – Value Added products http: //www. beginfinite. com/html/guinevere. html Archiving, virus scanning, footnotes, extension exclusion http: //www. omni-ts. com/index. asp? page=products&prod_id=18 Value added with some archiving capability 36 © March 9, 2004 Novell Inc.

Other Useful Links http: //www. gwtools. com/index. cfm • Number of products www. stack. co. uk/groupwise_footnote. htm • Disclaimers www. intellireach. com/groupwise/ • Management suite www. caledonia. net/catalog. html • Helpful tools and utilities http: //nps. kck. dk/nps/servlet/portalservice? Language=UK • Useful utility kit www. arma. org • 37 Association of Records Managers and Administrators © March 9, 2004 Novell Inc.

Lindsey’s links crmp@seattle. gov HIPAA Extract Provided by Elizabeth Cole Fifty state plus Canadian province URL table Provided by Jennifer Smith-Winkler, Records Manager, City of Seattle 38 © March 9, 2004 Novell Inc.

General Disclaimer This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc. , makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners. No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability. 40 © March 9, 2004 Novell Inc.