Network Computing is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them. Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Does IT Have to Worry about Compliance? (You Bet): Page 2 of 3

This concern has the broadest scope of the three. To manage compliant
retention periods, IT must be aware of both regulatory and industry policies
such as SOX or PCI, and corporate policy/internal governance such as deleting
all emails after 60 days. Note that the two are not necessarily in sync, and IT
has a responsibility for checking corporate policy against regulations. I'm not
suggesting that IT turn into the corporate compliance office, but corporate
deletion policies must be absolutely consistent, and must still be in
compliance with governmental regulations. Remember Arthur Andersen? They had a
corporate deletion policy all right, but amazingly enough only applied it to
Enron documents. Whoops.

Managing for retention does get tricky, which is why
compliance software with built-in and customizable hooks into policies is such
a very good plan. For example, eDiscovery vendors StoredIQ and Kazeon both
provide compliance hooks as part of their GRC (governance, risk and compliance)
capabilities. StoredIQ can also manage retention periods. Another vendor with a
compliance option for archives is Mimosa.

 

Ensure data availability for searches

In terms of compliance, this means that potentially relevant
data must be reasonably searchable in case of investigations. Tape is
acceptable as long as IT can locate and search potentially relevant data within
a reasonable time period. What constitutes reasonable? FRCP is whittling that
down from months to weeks. Generally if you keep indexes of what you've got you'll
be all right. Of course, that's saying a lot in some environments. Indexing software
will help here. The two vendors I already mentioned index across storage repositories,
as does Guidance. So does Index Engines for tape. And of course most ECMs and storage
arrays with management features should be able to search their own content for files
matching metadata and/or content.

If you are thinking that this is a useful feature for eDiscovery
as well as compliance, you're right. Classification technologies often work for
both concerns although it's eDiscovery that gets all the press.