The Role of Third-Party Archiving in Exchange 2010 An Osterman Research White Paper Published September 2010 SPONSORED BY!!!! Osterman Research, Inc. P.O. Box 1058 Black Diamond, Washington 98010-1058 Tel: +1 253 630 5839 Fax: +1 253 458 0934 info@ostermanresearch.com www.ostermanresearch.com Twitter: @mosterman!
Executive Summary OVERVIEW Archiving is, for all intents and purposes, the most versatile of email-related technologies because it impacts virtually user in an organization: IT staff that must manage the archiving platform, legal counsel that must use it in support of e-discovery and other litigation-related activities, senior managers that may want to perform early case assessment reviews, and end users that will interface with the archiving system to recover missing or deleted emails. Recognizing this, Microsoft has for the first time built archiving into its market-leading business email system, Exchange 2010. Because migration to Exchange 2010 is increasing at a very healthy pace and is among Microsoft s most successful server offerings, the profile and recognition of archiving as a key best practices is increasing as well. KEY TAKEAWAYS That said, while the archiving capabilities built into Exchange 2010 offer good functionality, they are limited in several important respects: The load on Exchange servers is not reduced as it is with many third-party archiving solutions that migrate data off of live servers and into archival storage. Single-instance storage has been eliminated in Exchange 2010. The e-discovery capabilities are fairly basic and will not satisfy more sophisticated requirements. Non-email content sources, such as public folders or SharePoint, are not supported in Exchange 2010. Archives in Exchange 2010 are decentralized. There is no offline access to Exchange 2010 archives. While the archiving functionality built into Exchange 2010 is very definitely a good first step, and while Microsoft is to be commended for including it in the offering, Osterman Research believes that third-party archiving and related solutions will be required to satisfy the majority of e-discovery, regulatory compliance and storage management requirements that exist in the market today and for the foreseeable future. ABOUT THIS WHITE PAPER This white paper focuses on the results of an in-depth survey that Osterman Research conducted with organizations in the context of their Exchange 2010 archiving plans. It also provides guidance on key issues to consider when planning an archiving capability, and also includes an overview of the sponsor of this white paper, Iron Mountain Digital. 2010 Osterman Research, Inc. 1
Survey Background and Methodology Osterman Research conducted an in-depth survey that focused on current archiving practices, as well as anticipated use of the built-in archiving capabilities in Exchange 2010. The goal of this research was to determine perceptions around Exchange 2010 s native archiving capabilities, as well as to determine how and why organizations would consider the use of third-party archiving systems. The survey was conducted during August 2010 and was completed with 106 individuals. The median number of employees at the organizations surveyed was 1,690 and the median number of email users was 1,500. Where is Data Management Today? EMAIL RETENTION PERIODS Required periods for email retention vary widely, from one year for personnel records to indefinitely for other types of content. Further, while regulatory agencies like the Securities and Exchange Commission are quite specific in terms of how long content must be preserved, most organizations that have primarily legal and not regulatory requirements to store data must deal with retention periods that are not nearly as well defined. Our research found that the mean retention period for email is 6.7 years and the median is three years. However, many organizations, while initially defining a retention period for email and other electronic content, often retain content for much longer periods a) for fear of discarding content that they might need at some point in the future, and b) because deletion policies tend to managed much less rigorously than retention policies. LEGAL DISCOVERY REQUESTS Our research found that there is a median of one legal discovery request per month in the organizations surveyed, although the mean was significantly higher because many firms, particularly very large ones, are involved in a large number of legal cases at any given time. Even using the median figure, however, this means that there is a median of 12 e-discovery requests per year per organization. It is no surprise, then, that e-discovery continues to be the primary driver for the deployment of email and other content archiving systems. While regulatory drivers are paramount for specific industries like financial services, energy and healthcare, the most important driver for archiving for the majority of organizations is litigation support: e- discovery, legal holds, early case assessment, etc. EARLY CASE ASSESSMENTS Early case assessment the practice of examining content in advance of a legal action to determine an organization s legal position is perceived by 49% of organizations to be key in helping to reduce the risk of losing that action. Similarly, 49% of organizations agree or strongly agree with the notion that early case assessment can help them decide which cases to litigate. Interestingly, 27% of organizations would like 2010 Osterman Research, Inc. 2
to perform early case assessment more often than they do, but they cannot do so at this point. Speaking to the important role of archiving as a tool in early case assessment is the fact that 57% of organizations believe that early case assessment is difficult in the absence of archiving, while only 25% believe that this practice continues to be difficult with archiving. Further, nearly three out of five respondents indicated their agreement or strong agreement with the notion that archiving is critical in the context of performing early case assessment well. ARCHIVING IS NOT USED SUFFICIENTLY One of the more interesting findings from the research is the relative lack of archiving capabilities that have thus far been deployed in the organizations surveyed. For example, when asked where organizations store email from former employees, the most common location was.pst files, followed by backup tapes, as shown in the following figure. The use of offline storage and backup tapes makes any future access to content very expensive for legal discovery purposes, not to mention the inability to place a reliable legal hold on content that must be preserved. Locations for Storing Email From Former Employees 2010 Osterman Research, Inc. 3
Plans for Archiving in Exchange 2010 SIGNIFICANT GROWTH PLANNED FOR EXCHANGE 2010 In a separate survey conducted by Osterman Research during August 2010, we found that organizations are planning a fairly rapid migration to Exchange 2010. For example, the research found that among the Exchange-enabled organizations we surveyed, 11.6% of the users have already been migrated to Exchange 2010; by August 2012 organizations using Exchange anticipate that 65.3% of their users will be on Exchange 2010. This is consistent with other research that shows that Exchange 2010 is among the most successful of Microsoft s server products and will realize quite rapid uptake during the next few years. AVERAGE MAILBOX SIZE WILL GROW IN EXCHANGE 2010 Osterman Research anticipates a significant increase in the average mailbox size in Exchange 2010 environments. Our research found that the median mailbox size will increase from 200 megabytes in Exchange 2007 and earlier versions to a median of 250 megabytes in Exchange 2010. By no means is this a surprising finding given that a key design tenet of Exchange 2010 has been support for larger mailboxes. PSTs ARE A KEY ISSUE IN EXCHANGE 2010 Our research clearly demonstrated that.pst files are a key issue in Exchange 2010: two-thirds of the organizations surveyed have.pst files that they would need to upload into Exchange 2010. However, only 37% of organizations have previously uploaded.pst files into a third-party archiving solution. MOST ARE NOT LIKELY TO USE THIRD-PARTY ARCHIVING YET Our research found that the vast majority of organizations do not plan to use a thirdparty archiving solution with Exchange 2010: for example, only 23% of survey respondents indicated that they would probably or definitely use a third-party archiving solution with Exchange 2010, while another 41% indicated that they would probably or definitely not do so. The remaining 36% indicated only that they might use a thirdparty solution in lieu of the built-in archiving capabilities of Exchange 2010. When asked if they will use Exchange 2010 to manage their email retention, 42% of respondents indicated that they simply don t know at this point an identical number indicated that they don t know if they will use a third-party solution to manage email retention. However, among respondents that have come to a conclusion about their use of Exchange 2010 or third party archiving, 43% indicated that they will use Exchange 2010 for email retention compared to only 24% that indicated they will use third-party tools. This means that all existing third-party archiving solutions will have an uphill battle to convince customers to change and incur the added expense of adopting another archiving solution. Considering the cost of many third-party archiving solutions, this is a significant challenge and, at first glance, it will slow the sales cycle considerably. However, there are two key issues at work here that will, arguably, be good news for vendors of third-party archiving solutions: 2010 Osterman Research, Inc. 4
First, archiving is still being adopted by many organizations. Several other Osterman Research surveys have found that just under one-half of mid-sized and large organizations in North America currently use any sort of archiving system. While many organizations believe they are archiving, in fact many are simply storing unindexed content on backup tapes or on disk-based backup systems. Consequently, the market for archiving in Exchange 2010 or otherwise still has considerable room to grow. Second, as we discuss later in this white paper, there are some shortcomings in Exchange 2010 s archiving solution that will motivate many decision makers to seek alternative solutions that are more in line with their requirements. Given that Exchange 2010 is still a relatively new system to many decision makers and is not yet deployed nearly as widely as it will be, these shortcomings will become much more apparent over the next 12-18 months as Exchange 2010 deployment hits its stride and as decision makers better understand what Exchange 2010 can and cannot do for them. ONLY ONE-HALF BELIEVE THEY CAN MANAGE E-DISCOVERY IN EXCHANGE 2010 One of the more interesting findings from the research is the fact that while most Exchange 2010-enabled organizations plan to use the native archiving capabilities of the platform, they anticipate that they would be able to satisfy only 54% of their e-discovery requests using the built-in Exchange 2010 capabilities and tools once the system is fully deployed. Not surprisingly then, 51% of organizations plan to use third-party archiving tools for e-discovery once Exchange 2010 is fully deployed. This will create a significant opportunity for third-party archiving vendors to sell the strength of their e-discovery tools along with their.pst archival capabilities. THE DUMPSTER IN EXCHANGE 2010 Exchange 2010 introduces a new and improved dumpster that offers significant improvements over older versions. End users can employ the dumpster to restore single emails that were deleted by mistake. Here is how it works: when an email is first deleted it moves to the Deleted Items folder. The email remains there until the Deleted Items folder is emptied. Next, the deleted email moves into the dumpster where it is held according to a retention property set by the administrator. Normally, the dumpster retention period is set for 30 days, allowing users to change their minds and restore deleted email within that period. Not surprisingly, many organizations do not yet know how they will use the dumpster feature in Exchange 2010 because of the relatively low number of organizations that have migrated their users to the platform. For example, 35% of survey respondents indicated that they do not yet know how many days they will let content stay in the dumpster before purging it, while 18% don t know if users will depend on the dumpster for item-level restores. Similarly, 53% of respondents do not yet know if they will use the legal hold option in Exchange 2010. However, among organizations that do have an opinion one way or the other: 2010 Osterman Research, Inc. 5
Setting for the dumpster: mean of 51 days, median of 30 days. Use of the dumpster for item-level restores: 59% will allow this for some users, 17% will do so for all users and only 6% will not permit this. Legal hold option: by a two-to-one margin, organizations plan to use this feature. With regard to the use of a third-party archiving system for item-level restores, 46% of respondents are not yet sure what they will do, although 23% indicated that they will be using third-party offerings for this capability. What this means is that third-party archiving vendors have an opportunity to educate the market on the value of the dumpster, particularly in the context of using it for legal holds and performing item-level restores. USE OF DATABASE AVAILABILITY GROUPS Database Availability Groups (DAGs) in Exchange 2010 have replaced the Local Continuous Replication (LCR), Cluster Continuous Replication (CCR), Single Copy Clusters (SCC) and Standby Continuous Replication (SCR) capabilities that were available in Exchange 2007. However, while the SCC and LCR functions were eliminated, the SCR and CCR functions have been combined into the new DAG functionality in Exchange 2010. There are a number of advantages to the use of DAGs, including faster failovers than in previous versions of Exchange, more efficient backups, the ability to support up to 16 mailbox servers in a single DAG and improved security. Our research found that that majority (55%) of respondents do not yet know if they will use DAGs for Exchange 2010 database-level protection, 69% don t know how many DAG copies they will implement and 64% don t know if they will implement a removable DAG for disaster recovery purposes. These results are not at all surprising given that most organizations have not yet deployed Exchange 2010 and have simply not gotten to the point at which these decisions need to be made. However, most organizations have determined the role of traditional, third-party backup solutions for Exchange in an Exchange 2010 environment: 52% will use them and 20% will not, leaving only 28% unsure about the role of third-party backup solutions in their Exchange 2010 environment. This is not at all a surprising finding given that administrators tend to be fairly conservative with critical information assets, so even with DAGs which have been designed, in part, to reduce the need for backups they will continue to employ the practices with which they are familiar. USE OF EXCHANGE 2010 ARCHIVING FOR EARLY CASE ASSESSMENTS As noted earlier, many decision makers view early case assessment as an important best practice in the context of managing litigation and reducing overall corporate risk. However, our research found that one-half of those surveyed do not yet know if they will use the archiving functions within Exchange 2010 to perform them, while one-third have already decided that they will do so. 2010 Osterman Research, Inc. 6
Why Should You Consider Third-Party Archiving? EXCHANGE 2010 IS A GOOD FIRST STEP As noted earlier, the goal of this white paper is not to criticize the archiving functionality built into Exchange 2010. On the contrary, the mere presence of archiving capabilities in the platform is a signal from a market-leading vendor about the importance of archiving email and other content, and it will serve to boost the market for archiving by elevating the importance of this practice in the minds of many decision makers. Plus, Exchange 2010 s archiving capabilities are not without merit they provide some useful functionality and will satisfy some organizations archiving requirements quite nicely. WHY THIRD-PARTY ARCHIVING? However, Osterman Research believes that the majority of organizations that deploy Exchange 2010 will still require the use of third-party archiving solutions. Here s why: No load reduction on Exchange servers Fundamentally, the Exchange 2010 archiving capability does not reduce the load on Exchange servers as many third-party solutions do. Because the archiving system is on-server, content is not moved to slower and less expensive media, negating a key advantage available with many third-party archiving solutions. Lack of single-instance storage There is no single-instance storage capability in Exchange 2010 s archiving system. While there are some good reasons for doing this, the use of single-instance storage is a key benefit of many third-party archiving systems and one that many IT administrators will miss. Larger mailboxes, while useful, can create problems The use of larger mailboxes in Exchange 2010 offers a number of advantages, but some disadvantages, as well. These include additional strain on bandwidth, longer backup and restore times, and problematic disaster recovery. E-discovery capabilities are basic While the e-discovery capabilities built into Exchange 2010 can provide some useful e-discovery functions, they are unlikely to satisfy more sophisticated e-discovery requirements. This will mean that a third-party solution will still be required for most e-discovery exercises. No archiving of non-email content Exchange 2010 does not archive public folder content or other data stores, such as Microsoft SharePoint. Because the majority of organizations that archive want to retain all Electronically Stored Information (ESI), this is a problem that will necessitate the use of third-party archiving solutions, at least for non-email content. Given that the use of multiple archiving capabilities will complicate e-discovery and other litigation support functions, many organizations will likely opt for a single archiving solution. 2010 Osterman Research, Inc. 7
Requires the use of Outlook 2010 The archiving capabilities in Exchange 2010 require the use of Outlook 2010 and a corresponding enterprise Client Access License (CAL). While many users will migrate to Outlook 2010 over the next few years, experience has shown that migrations that impact end users tend to require significant amounts of time and IT labor to accomplish and happen fairly slowly. Archives are decentralized Archives in Exchange 2010 are decentralized and so are stored along with mailbox servers. While not an inherent flaw per se, this can be problematic for organizations that want to centralize their archives. Other issues Other issues with Exchange 2010 archiving include the fact that there is no offline access to the archive and management of the archive can be more cumbersome than in other archiving solutions. Next Steps STEP 1 The most important step for any organization is to determine how and why archiving will be used. Because email and other content archiving is a critical necessity to support e- discovery, legal holds, early case assessment, regulatory compliance, storage management, data mining, business continuity and other activities, organizations must determine how not if archiving will be used in their organization. STEP 2 Next, it is imperative that archiving policies be established so that content of specific types will be preserved for the appropriate lengths of time. Retention periods will vary based on a number of factors, including regulatory requirements, advice from legal counsel, industry best practices, internal corporate policies, etc. In addition, it is important to establish deletion policies so that content is not retained for longer than necessary. STEP 3 The next important step is to understand the archiving capabilities built into Exchange 2010 and what they can do and not do in support of specific retention, deletion, e- discovery, compliance, storage management and other requirements. As in the other steps, it is important to consider long-range archiving requirements in the context of scalability, features, future retention requirements the like. STEP 4 Finally, evaluate third-party archiving solutions and the additional features and functions they offer that Exchange 2010 archiving does not. Again, the goal here is not to dismiss Exchange 2010 archiving outright, but to honestly evaluate its limitations and consider offerings that can best meet an organization s requirements. 2010 Osterman Research, Inc. 8
About Iron Mountain Digital Iron Mountain enables enterprises to harness the value of their unstructured and semistructured information, and improves business process performance and productivity. As the recognized visionary in enterprise content archiving, Iron Mountain is driving innovation in the industry and is continually delivering cutting-edge solutions to address the evolving needs of customers around collaboration, communication, productivity and social media. Iron Mountain delivers next-generation content archiving solutions with its NearPoint solution platform. Iron Mountain NearPoint is the industry's most comprehensive solution unifying email archiving, file archiving, and SharePoint archiving with recovery and storage consolidation. With policy-based retention and a sophisticated ediscovery application, Iron Mountain NearPoint enables enterprises to reduce risk, lower ediscovery costs, and enforce corporate governance and compliance. Iron Mountain NearPoint enables IT to gain control over their enterprise content deployment, reduce storage costs, increase data availability and improve operational efficiencies. Iron Mountain NearPoint for Microsoft Exchange provides complete capture of Exchange information with multiple capture methods, full-text indexing, global single instancing, and flexible and granular retention and disposition management. Endusers have self-service access to enterprise information via Outlook, OWA, web browsers and a variety of hand-held devices. For legal, compliance and records management, Iron Mountain provides a powerful set of applications for in-house ediscovery and case management, content monitoring and supervision and automated retention and classification. Exchange Administrators use NearPoint for storage optimization, PST archiving, and coarse and fine-grain recovery. Iron Mountain NearPoint for SharePoint provides a comprehensive solution to manage the breadth of SharePoint content types with unified archiving, recovery, and ediscovery, while maintaining seamless end-user access to archived information. Iron Mountain NearPoint for SharePoint protects your entire SharePoint farm and recover an entire farm, server or an individual list item with only a few clicks. Iron Mountain NearPoint File System Archiving (FSA) provides archiving, stubbing, end-user secure search, ediscovery and content monitoring across files and document types residing on a variety of platforms. The Iron Mountain next-generation architecture is unique and differentiated in the industry due to its scalability, ease of implementation and use, and no load on production content systems. The Iron Mountain platform is built on a highly scalable and cost-effective grid architecture designed for global deployments of hundreds of thousands of users with high data volumes. The Iron Mountain platform is offered as a stand-alone or fully integrated solution for email, files and SharePoint. It is extended with value-added applications: ediscovery, Content Monitoring, Advanced Retention and Classification, PST archiving, Tiered Storage and Disaster Recovery. Iron Mountain NearPoint is an open platform enabling the ingestion and access of content by a variety of third-party ediscovery and Records Management applications. Iron Mountain 2010 Osterman Research, Inc. 9
NearPoint serves as an information management platform for corporate ediscovery products and processes. 2010 Osterman Research, Inc. All rights reserved. No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc. Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader s compliance with any laws (including but not limited to any act, statue, regulation, rule, directive, administrative order, executive order, etc. (collectively, Laws )) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL. 2010 Osterman Research, Inc. 10