Iron Mountain Inc. this week announced a consulting service aimed at helping financial services firms comply with increasing pressure from regulatory agencies to store internal and external electronic correspondence.
Boston-based Iron Mountain said its Records Management Program Gap Analysis service can gauge a company's retention approaches and recommend changes, including the addition of e-mail archiving and search capabilities that can be outsourced or developed in-house.
David Young, director of business systems at the Common Fund for Nonprofit Organizations, a broker/dealer in Wilton, Conn., said he began using Iron Mountain's message archiving and search service for Microsoft Exchange in January because of regulatory pressures and an increased threat of litigation.
The U.S. Securities and Exchange Commission requires financial services firms to store all e-mail traffic in its original form for at least three years and to make those communications "accessible" for the first two years. The National Association of Securities Dealers Inc. also has rules that require brokerages to monitor and store communications with their clients.
Young said that trying to comply with the retention rules on their own can become "an administrative nightmare" for IT managers. "You've got boxes [of paper documents] to deal with, optical storage to deal with; you need additional IT support for disaster recovery; and you need to make sure your servers are up and on the network," he said.
Brian Babineau, an analyst at Enterprise Storage Group Inc. in Milford, Mass., said a cottage industry has grown up around regulatory compliance within the financial services market. But he cautioned that outsourcing isn't always the right answer, although it's more often the smart one for small to midsize businesses.
Legal 'lockstep'
Babineau said CIOs and corporate attorneys need to work in "lockstep" to fully understand the message-retention rules and then determine whether their companies face compliance risks. He added that even large Wall Street brokerages with sufficient IT resources have to be careful to ensure that companies they acquire are compliant.
"It's not the e-mails created two months ago you have to worry about as much as the e-mail created two years ago when you brought [the new company] on board," he said.
Iron Mountain's e-mail archiving service, which was announced in January (see story), uses EMC Corp.'s Centera disk arrays and Arlington, Texas-based KVS Inc.'s mailbox management and compliance supervision software. But Iron Mountain officials said the gap analysis service can be used separately to help IT managers prepare for development or upgrades of in-house archives.
Charles Bennett, director of compliance at Horner, Townsend and Kent, the broker/dealer division of Penn Mutual Life Insurance Co. in Horsham, Pa., said the company's 16,000 sales representatives can generate as many as 12,000 e-mail messages per day. Bennett added that he plans to begin using Iron Mountain's Web-based archiving service this month.