Wall Street crisis forcing a closer look at e-records

"I don't know if it's necessary," he said. "If they enforce the stuff they've got, we should be fine."

Savarino, who has been advising IT managers on data retention issues for the past seven years, said companies that are implementing retention systems today often do little more than keep data for 30, 60 or 90 days and then hit the delete button. In such cases, legacy documents are unavailable and it isn't possible to show trends over time, he noted.

"I do not subscribe to the 30-, 60-, 90-day policy. I think they are woefully inadequate, and I don't think they comply with most rules and regulations," Savarino said. "When regulators audit regularly and investigate regularly, that's when they're going to start discerning who's keeping e-mail and who's not. They just haven't been doing that on a regular basis."

Savarino said IT managers and corporate legal departments should take the following three steps to prepare for the coming oversight onslaught:

• Learn what the data retention laws require specific industries to do.
• Install packaged archival and retrieval tools, because it's too difficult to handle those tasks manually.
• Utilize outside legal counsel.

"I know that sounds self-serving," Savarino acknowledged, "but outside lawyers can help companies figure out what the laws are and establish retention schedules and determine how to set up electronic archive 'buckets' to hold on to e-mail and documents."

Lawyers can also help set policies, procedures and parameters to deal with litigation holds, which require firms on notice of a potential lawsuit or government investigation to retain all potentially relevant electronic documents. Two years ago, Congress approved the Federal Rules of Civil Procedure, which set a baseline for which electronic documents must be retained and retrievable by corporate litigants in a court case.

Nonetheless, most companies "are standing there like deer in the headlights," Logan said.

"We have to have a more disciplined process for working with electronic records regulations," she said. "We need to have people in charge of managing information for the entire company. Today, everyone's expected to manage their own data."

As e-discovery pressures grow, companies and regulators must work together to determine which business documents are truly critical, Logan added. "People have to start throwing stuff away. It's not all precious," she said. "There needs to be some change to separate the wheat from the chaff."

This version of the story originally appeared in Computerworld's print edition.

Read more about storage in Computerworld's Storage Knowledge Center.