|  |
To keep or not to keep? Email and Instant Messaging add to record management risks
Report highlights costs and legal implications of record management and discovery
Record management is becoming a costly legal and technology minefield that is further complicated by email and Instant Messaging (IM) technologies along with the increasing business use of other forms of messaging such as mobile SMS and even IP voice, according to a new report from the Information Security Forum. In particular, a survey of ISF Members suggests that the decision whether to retain email and IM as business records is far from clear.
"There are an increasing number of laws and regulations, including money laundering, that require organisations to manage and retain business records, but the law doesn't necessarily view email and IM as simply casual and unofficial communication - they can sometimes form business records." says Andy Jones, senior research consultant at the ISF. "On the other hand, data privacy laws may prevent the retention of records that are intended to be private."
The possible breach of legal requirements for email and IM is just one of the many risks associated with record management highlighted by the ISF. Others range from breaching different countries' retention requirements when operating internationally, through to bad publicity resulting from a failure to protect confidential records. And with the increasing volume of information flowing in and out of organisations, storage costs and the risk of technology obsolescence can present major problems for those responsible for record management.
The need to be able to provide records subject to legal discovery in a timely manner and prove their integrity is another challenge. There are a growing number of legal discovery actions, particularly in the USA, and if a record can't be found there is a risk of the case collapsing and the organisation being held legally responsible.
According to the ISF, the problem of record management is not helped by the lack of clarity within an organisation over ownership and responsibility - not surprising when records are seldom owned by a single department. The survey of ISF Members found that only a small number of respondents had a specialist record management function and often information security took some responsibility by default. "Record management simply sounds technical - but is largely a business problem," says Jones, "requiring clear business ownership, supplemented by a technical solution."
Based on the practical experiences of ISF Member organisations, the ISF Report provides a list of good practice actions for record management. This includes assigning business roles and responsibilities, creating a record retention policy and using a risk approach to assess which documents should be managed as business records. 18.05.2006, Information Security Forum
Subscribe to the newsletter | | |
| | | |
