IT executives are overconfident about their ability to respond to litigation events due to recent infrastructure investments \n\nto address new e-discovery rules, according to a new research report by IDC (a sister company \n\nto CIO.com's publisher). \n MORE ON CIO.com\n \n Legal Issues: 5 Tips for Electronic Discovery\n \n Rules of Evidence - Digital Forensics Tools\n \n How to Comply With E-Discovery Rules Before You're Hit With a Lawsuit\n \n Electronic Records Management: Are You Sure You Want to Save That?\n In late 2007, FTI Consulting Inc. commissioned IDC to survey 118 IT executives to evaluate their knowledge of their firms' \n\ncurrent electronic discovery and regulatory audit activities, assess the current state of litigation response and readiness \n\namong U.S. businesses, and identify current and planned technology investment priorities in support of litigation response \n\nand readiness initiatives. The study concluded that IT executives are confident about their current abilities to respond to a litigation event, given \n\nrecent investments in records management, archiving and information retention intended to address some of the amended Federal Rules of Civil Procedure (FRCP) for electronic discovery. However, the data from the survey highlights an urgent need for organizations to adopt standardized policies and IT \n\npractices for activities related to the identification, preservation and collection of potentially responsive data. The \n\nexistence of ad hoc and manual business processes exposes a litigant firm to potential challenges to its litigation hold \n\npractices. Is Your Corporate Information Infrastructure Ready for a Litigation Event? The tight deadlines imposed by Rule 26(f), combined with the continued explosion of ESI (electronically stored \n\ninformation), require corporations to adopt a records management and information retention practice (also known as \n\ninformation management), an e-discovery response plan, and a legal-hold best practice. Corporations need to accomplish these \n\nactivities so that they are able to meet their expected conduct and responsibilities\u2014and, more important, have \n\nsufficient information to craft their e-discovery and legal strategies when needed. Nearly 79 percent of the IT executives surveyed rated their ability to respond to a litigation event from above average \n\n(rating of 4 on a scale of 1 to 5) to very well prepared (rating of 5 on a scale of 1 to 5). This confidence is primarily \n\nbased on existing records management and information retention infrastructure investments. Companies deployed records \n\nmanagement, messaging, document management, archiving and information security solutions to demonstrate the consistent \n\nenforcement of their records management and information retention policies. These investments serve as the first line of defense against "spoliation." The visibility that a well-developed records \n\nmanagement and information retention practice provides facilitates legal strategy. However, a separate IDC survey, "Active \n\nArchiving: Preservation, Retention and Reuse," conducted in the summer of 2007, suggests that corporate records management \n\nand information retention practices are, for the most part, application-specific and relatively immature. Corporations are \n\nonly starting to address their potential legal liabilities from the absence of a well-defined governance practice for other \n\ncontent types such as Microsoft SharePoint, voice and video. A large majority are also grappling with the disposition of \n\nlegacy data. Litigation Hold and EnforcementA litigation hold is designed to preserve all documents and electronically stored information that may be relevant to \n\nlitigation. Enforcing and managing a legal hold involves discrete processes and requires corporations to orchestrate \n\nactivities across multiple stakeholders. Courts have imposed severe penalties against parties who have failed to meet these \n\npreservation obligations. The FRCP requires that companies have demonstrable and consistent practices for responding to and enforcing a litigation \n\nhold across a myriad of applications and content repositories and across heterogeneous platforms and distributed IT \n\nenvironments. In theory, adopting litigation response best practices and using tools to automate key activities around the legal-hold \n\nprocess would benefit the organization in several ways:\n\nIt could provide manpower cost savings and process efficiencies.\nIt would facilitate the management of multiple litigation events.\nIt would enable the organization to demonstrate the consistency of its litigation response practices to the courts. \n\nAccording to the data, companies have a long way to go to realize those benefits to their fullest extent. \n\nE-discovery practitioners recommend that corporations adopt policies and procedures for enforcing the legal hold. IDC's \n\nresearch concludes that corporations are enforcing the legal hold on an application and content-store basis. When the \n\npotentially responsive ESI is located in an archival or records management application and the application features the \n\nrelevant workflows and business rules, they would enforce the hold in place. Some corporations are also making the decision \n\nto ingest ESI from legacy media (like backup tapes and drives) and uncontrolled data stores (like their network file shares, \n\nservers and desktops) back into their content archives as a way to meet their preservation obligations. \n\nAutomated in-place legal hold is predicated on the existence of documented policies and technical procedures for the \n\nsuspension of routine deletion practices. IDC's interviews with the legal and compliance practitioners conducted a month \n\nbefore the survey fieldwork suggest that corporations were only starting to formalize these practices. Yet the study shows an \n\nunusually high proportion of IT executives who claim that their existing content archiving and records management \n\napplications support automated legal-hold workflows. \n\n While 86 percent of survey respondents claim to have formalized litigation communications policies in place, adoption of standardized processes and the ability to automate and document communications across \n\nrecords management, legal and compliance departments is lacking. Approximately 55 percent of the companies surveyed are still \n\nin the early stages of automating the litigation communication process, 29 percent are using voice communications and \n\nin-person notices and 13 percent are still using paper-based surveys. There should also be a way to provide continuous and \n\nauditable transparency of the hold duties and create linkages that validate custodian attestations with the actual state of \n\nthe legal hold in the content repositories. \n\nAll Dogs Must Learn New Tricks \nThe absence of formalized processes, communications policies and means to enforce litigation holds underscores an urgent \n\nneed to educate IT organizations and their legal and compliance counterparts about each other's actions and activities during \n\na litigation event. \n\nIT professionals need to better understand the language of their compliance and legal discovery counterparts and be more \n\ncognizant of the technology requirements for managing and processing data during a litigation event. For starters, it is \n\nimportant to recognize the distinct but complementary relationship between their information management practice and their \n\nlegal hold procedures. A resulting lack of understanding between the two can contribute to IT's overconfidence in its \n\ninfrastructure's abilities to support the legal-hold process. \nIT should be aware of issues that would interfere with the IT infrastructure's ability to automate the consistent \n\nenforcement of information management and retention policies. \nAdditionally, IT needs to do a better job understanding the potential dormant liabilities that may arise from its \n\ntechnology decisions in processing and handling data. \nIT executives need to work more closely with their compliance, records management and legal counterparts to ensure that \n\nthe IT processes and infrastructure are able to support the end-to-end records management and information retention \n\nlifecycle. \n\nAn effective means to begin communication between IT and other functional areas is to create cross-functional core \n\nlitigation response teams\u2014groups assembled for identifying custodians and scoping out litigation holds. \n\nFor companies prioritizing automated legal-hold workflows as a critical requirement, coalescing policies and best \n\npractices for enforcing, managing and tracking legal holds by application and content is the place to start. Initial efforts \n\nshould focus on the most popular target sources for electronic discovery in litigations, investigations and audits. \n\nVivian Tero will present the full findings and recommendations from this study during a live webcast on June 19 at 1 \n\np.m. Eastern Daylight Time. For \n\ncomplimentary registration, please click here. \n\nVivian Tero is the program manager for IDC's Compliance Infrastructure Service. Ms. Tero's primary focus is research, \n\nanalysis, and strategic advisory on information and system infrastructure technologies that facilitate legal discovery, data \n\nprivacy and IT GRC (governance, risk management and compliance).