The Seven Deadly Sins of Records Retention
Records retention periods are increasingly governed by regulations. Here are worst (and best) practices for securing data and documents.
CSO —
Sure, you're thinking, records retention can be deadly. Deadly dull. "I don't want to own that," TriWest Healthcare CSO John Pontrelli said to himself when people came poking around about it—this after the U.S. Department of Defense, TriWest's only customer, announced it was going to audit the company's document retention practices.
"It's just one of those thankless kinds of jobs," Pontrelli continues, noting that he'd rather keep his security staff focused on its core business. "I can't become the retention police."
Records retention has always been about as sexy as Birkenstocks with socks. Even the nomenclature, retention, has an unsavory connotation, something better left to the clinically uptight. But recent legal actions have made document retention programs not just boring but risky. One wrong step can cost a company. Just ask the latest poster child, Morgan Stanley, which in May said it would pay a record $15 million to the Securities and Exchange Commission for failing to properly retain or produce e-mails related to several investigations. And the regulatory environment is unlikely to soften anytime soon, with Internet service providers now under particular scrutiny, as the government seeks access to customer information for child pornography cases.
To avoid having anyone hit a $15 million delete key, some companies have concluded that they should archive, forever, anything and everything—boring and unboring, sexy and unsexy, damning and defensible—just to err on the safe side. But that's not quite right either.
In records-retention land, there is no "safe side." Keeping too much information is a risk too. "If you retain [a record] for too long, it's very expensive, you expose yourself to litigation risks, and you might be violating privacy rights," says Edward R. McNicholas, a Washington, D.C.-based partner at the law firm Sidley Austin.
Sound like you're damned if you do, damned if you don't? We're here to help you avoid either extreme, by offering seven common mistakes—dare we call them deadly sins?—and strategies to avoid them.
1. Not keeping your records straight from your backup.
First, the basics. The first step to a good records management program is simply identifying what a record is. Sure, the e-mail servers and network drives get backed up at the end of the day or week. You need those backups to keep the business running. But a record, technically, is something that you need to keep around for a set period of time, either for regulatory, legal or business reasons. Records encompass both structured information, like financial transactions stored in the company's enterprise resource planning system, and unstructured information, like financial spreadsheets exchanged by e-mail that might eventually feed into the ERP system (or just sit on someone's desktop computer indefinitely). Records probably don't encompass e-mails exchanged by two accountants about whether to lunch on Thai food or Mexican.
"You have to boil it down to, what are your storage requirements versus your legal requirements to retain business documentation?" says John Petruzzi, director of enterprise security for Constellation Energy, a $17 billion company based in Baltimore. The two things can be very different. For instance, while backup media may be in a continual state of being written and overwritten, records that must legally be retained (more on that in a minute) often need to be stored on immutable, nonrewritable storage, and should be either very well-organized, very easily searchedor both.
