Of course, the first step is acknowledging the problem. "The legal community doesn't care whether the target of litigation is a big company or a small company. So even as an SMB, you must think about these issues, even if it is simply being able to defend yourself from a disgruntled employee," says John Webster, an analyst at
How you achieve the right level of protection, "is an equation that will be different for each SMB," Webster says. For many companies, doing nothing, which incurs no direct cost, will remain an appealing option, "until something happens and the real cost of doing nothing is revealed," he adds.
"People often make the assumption that because a company is small, it has limited requirements," says Gartner analyst Carolyn Dicenzo. However, she notes, the requirements for email archiving and retention at a law firm or a very small pharmaceutical firm are just the same as for the giants of the business. "When it comes to email archiving, it isn't a question of how big you are, but of what your requirements are," she stresses.
Fortunately, she notes, there are a wide range of options. For SMBs willing to attempt the task of email management and archiving themselves, there are many tools available, including:
DiCenzo says that short list is representative, but neither comprehensive nor exhaustive. Indeed, she says, the fragmented market has defied easy analysis because SMBs have such diverse requirements. That fragmentation, and the fact that archiving can be so critical, has led to big growth among service providers.
The service providers have "gotten much more robust and cost efficient so as an SMB you now have an opportunity to do archiving and, in some cases, have someone who will help you if you get into a legal discovery process where you need to construct thorough and accurate searches," she notes.
For small companies in financial markets where you need tamper-proof and auditable copies of emails, a service company can often deliver the goods and even help you pass SEC audits, she notes. Furthermore, DiCenzo says the universe of service providers is expanding. For example, Google has announced an archiving and discovery service based on Postini, while Dell has responded with the acquisition of MessageOne, resulting in a low cost archiving service designed to meet Federal Rules of Civil Procedure discovery procedures.
Companies outside of the U.S. (as well as some within) have also begun to look at archiving outside of the country. "Some people don't want data sitting physically within the U.S. because they are afraid of the Patriot Act," explains DiCenzo. Service providers such as Fortiva and Global Relay Communications have sprung up in part to address this concern.
However, DiCenzo says, the biggest news is market momentum, with the number of customers using service providers for email archiving up sharply from about 700 in 2005 to around 8,000 today. "Email archiving is something just about everyone wants to do and with each new release of Microsoft Office driving up file sizes and attachments, the task of management is pretty onerous," says DiCenzo.
"While everyone is afraid of discovery, most companies are doing the right thing -- so what's at issue is their ability to document that," says DiCenzo. "The fact is that sometimes simply being able to produce data means that you win the case," she adds.
For those still unable or unwilling to commit to either managing technology solutions themselves or paying a service provider, Webster says there is still the option of at least implementing better and more thorough policies. "In general, you can set any kind of deletion and retention policy you want as long as you follow it consistently," he notes. In other words, he explains, you can't appear to have treated emails about sensitive subjects differently from other emails.
"Working with a lawyer is crucial to that process, but if you do get a good policy in place, it can help simplify your management and retention challenges from the start," he says.
Alan Earls is a frequent contributor to SearchSMBStorage.com.
This was first published in June 2008