Project Manager:

John Baines, Security & Compliance Assistant Director, john_baines@ncsu.edu, (919) 513-7482

Project Background

Purpose

There is a need to review, update and establish e-mail retention and archiving policies for the NC State Campus Community and recommend implementation and enforcement guidelines. Recent factors that need to be considered include:

1. State law interpretation regarding e-mail as a public record at the university as provided to the task force by the University General Counsel
2. Results of the E-Mail Records Review Panel appointed by North Carolina State Governor, and the associated Executive Order No. 150 regarding ‘E-Mail Records Retention and Archiving’
3. University records retention policy as expressed in NCSU REG01.25.12, the UNC-GA University General Records Retention and Disposition Schedule and NCSU REG08.00.9 - University E-mail Retention  
4. Public records and privacy law requirements for responding to requests for public documents with appropriate redactions based on privacy laws
5. Litigation holds, e-discovery requests, responses to subpoenas for e-mail evidence, and other aspects of handling e-mail evidence required to support litigation
6. Implementation of the WolfWise centrally-supported calendaring and e-mail system for staff and faculty

Overview

The task force was formed by the university CIO, Dr. Marc Hoit. The first meeting of the Task Force was held on December 19^th 2008. The appointed Task Force Members are:

• Facilitated by John Baines – OIT Security & Compliance Unit
• Mardecia Bell, OIT Director of Security & Compliance Unit
• Marc Hoit, Vice Chancellor for Information Technology and CIO
• Leo Howell, Internal Audit
• MaryBeth Kurz, Vice Chancellor for Legal Affairs and General Counsel
• Andy Raynor, AITD Representative
• Greg Sparks, OIT Director of ComTech Unit

The goal of this task force is to study the issues surrounding e-mail retention and to produce the following deliverables:

1. A report of recommendations as to how regulations may be implemented
2. Simplified policy documentation for the retention of campus e-mail
3. A recommendation for an updated regulation for the retention of campus e-mail

The task force will complete its work by June 30, 2009. The formal review process for the report of recommendations will begin at the March 2009 meeting of the UITC.

Goals & Objectives

Establish a detailed price model for storage to be used for budgeting and capacity planning for OIT internal projects and charged services:

• Develop a tiered architecture and services model that balances availability, performance, stability, data protection and costs
• Create simple tiers of services for non-OIT customers that make block level storage and/or file services available offering enterprise class storage and backups with lower departmental costs
• Create a communications channel for storage related projects within OIT and across campus
• Develop a plan to minimize overlap of existing OIT storage technologies to reduce costs and improve manageability
• Create a group to begin the design of the next generation OIT file services model.
• Develop a recurring assessment of the amount, types, growth, location of campus data both centralized and decentralized
• Review existing OIT storage technologies in light of data retention and compliance requirements as well as disaster recovery preparedness

This project will support the OIT operational goals of Proactive Customer Service and Solutions, Collaborative Engagement, and Reliable Systems and Security.

Scope

The scope of the E-mail Retention Task Force recommendations applies to the use of e-mail systems for conducting or relaying information about University business. E-mail message authorship and recipient status will include staff and faculty only. Student e-mail messages will only be considered to the extent that the student is also an employee of the University.

The scope of content to be considered by the task force will include unified document messaging, specifically e-mail (plain text and HTML), electronically-stored faxes, linked attachments (by various means) including voice files, and calendar appointments.

Factors initially studied by the task force include:

1. E-mail as a public record, what needs to be retained and how to categorize?
2. E-mail records retention, how long do we need to keep e-mail of various types?
3. Litigation holds, e-discovery, and subpoenas for e-mail evidence associated with litigation – how to handle?
4. How to preserve the professional knowledge base constituted by each individual’s saved e-mails?

Authority

Approval authority of the recommendations of the task force will rest with the CIO, but endorsement will need to include Academic IT directors, the University IT Committee, and those Deans whose colleges support their own e-mail systems.

Major Constraints and Assumptions

xxxxx

Start Date

December 19, 2008

Expected End Date

December 31, 2009