Rossander’s Security Reader

This article was originally published in the May 2007 edition of The Agent Newsline, a publication of Westfield Insurance.

What you need to consider from Information Security

How is your Records Retention program? Do you have one? Are you following it? In December 2006, the U.S. Supreme Court released new rules regarding the finding and turning over of electronic documents in response to a subpoena or other court request. Among other requirements, the new rules make it clear that every company must have a records retention/destruction policy that is strictly followed.

With that in mind, your document retention/destruction policy must find the balance between potential future benefits of a document and potential future costs of holding that document.

Think through the total costs of holding a document.

Documents are accumulating at an incredible rate. Who will wade through the archives to find the relevant document? Who will remove all protected or irrelevant hits from your search, and how much will you have to pay that person? (If it is a lawyer in response to a subpoena request, the answer is "a lot.") Even if you do find the document, will you be able to open it? What operating system did it run on? What hardware did it require? What will you do about the inevitable files that go corrupt? What storage medium will you use? These are just some of the questions you must consider.

Unless you have a carefully architected solution for document storage and categorization, your costs for electronic storage can skyrocket over time. If you have a copy of the document, the court can order you to produce it, forcing you to spend money to convert it into a format that they want and can read. Good companies have been forced to spend several millions of dollars recovering old versions and restoring old systems just to get through the discovery phase of a suit.

Then there are the legal liabilities of holding onto documents longer than is necessary. We all write things occasionally that we regret. Courts have said repeatedly that as long as you still have a copy of that message, it must be turned over. However, if you destroyed it in the normal course of business and in accordance to your own policy, the courts do not normally require you to go to extraordinary measures to undelete and recreate the document.

Remember that you also need the ability to centrally suspend the destruction cycle when you receive (or reasonably believe that you will receive) a court-ordered litigation hold. Courts have been unforgiving to companies that fail to suspend their destruction programs. Have a policy and follow it strictly.