Monday, July 27, 2009

Security Manager's Journal: Writing a data retention policy isn't as simple as it sounds

Establishing a policy on how long data must be retained seems easy enough. It isn't. For starters, not all data is the same.

Trouble Ticket
At Issue: It's time for the company to set a new policy on data retention.
Action Plan: Normally, our manager would want to write it. But this time, it's better to let the lawyers take charge.

I got lunch in the company cafeteria last week, and we may end up saving over $40,000 a month as a result.

That's because I bumped into our head legal counsel while waiting in line. "When," I asked, "are we going to drop the requirement to retain all data?"

For several years, we have been forbidden to overwrite any data related to e-mail, home directories, financial systems and several other document repositories and systems. This ban arose from a stock-options grant investigation, now long concluded. Being barred from overwriting backup tapes comes at a cost; we're spending about $40,000 a month just for new tapes. More costs arise because we are prohibited from overwriting the hard drives of departed employees. At least that cost was alleviated recently with a new initiative to capture images of those hard drives before reassigning them to other employees.

Couldn't we relax the retention policy and get back to a normal state of affairs? I asked him. Yes, we could, he said, but not until we create a comprehensive data-retention policy. You could help, he said.

To Continue Reading: Click Here
---------------------------------------------------
Source: computerworld.com
By Mathias Thurman

0 comments: