Many organizations are taking advantage of using a wider range of communication systems and technologies than ever before. For example, just to name a few:

• Voice over IP (VoIP) is used not only for voice communications but also often integrated with the corporate email system.
• Instant messaging (IM) is commonly used to allow real-time interactive business communications.
• Blackberry messaging devices are used by a large number of business personnel to send and receive email no matter where they are at, at any time of the day.

Many companies have been burned in many ways (revenue loss, stock value drops, reputation damage, etc.) as a result of lack of planning for retaining specific types of data inappropriately, as well as for destroying data that was court-ordered to be retained; recall the July 21, 2004, judgment against Philip Morris USA, Inc. to pay $2.75 million for destroying emails related to litigation.  There are probably thousands, if not tens of thousands, of lawsuits going on against organizations on any given day.  In many, if not most, of these cases there are data discovery issues that require organizations to be retaining specific types of data.  Because of the highly distributed locations where data is now stored, it is likely many of the storage locations are unknown, or are under the control of end-users who may be doing things with the data that can have huge impact in court and on the organization.

The evolving systems and technologies are certainly timesaving and efficient business tools. However, business leaders need to consider the archiving, retention, and discovery requirements that are involved with these technologies to ensure they are not unknowingly putting the business at information security, privacy, and/or legal risk with the ways in which the technologies are implemented. 

This week I posted a paper, "The Business Leader Data Retention and E-Discovery Primer" within which I discuss some of the important data retention and electronic discovery issues that organizations must consider and plan for.  These issues can cost organizations much time, resources and money if not addressed properly.

Technorati Tags
information security
IT compliance
regulatory compliance
electronic discovery
e-discovery
data retention
policies and procedures
awareness and training
privacy