When you're talking about documents transmitted electronically, however, it becomes almost impossible for an organization to effectively enforce a document destruction policy. I have read internal reports where organizations estimate that there are at least 16 or more copies of most business documents spread throughout their network. This is mainly due to people including an original message and attachments in their replies.
Documents distributed beyond the corporate network represent a significant concern. Deleted documents can often be recovered easily, while additional versions of a document may unknowingly exist elsewhere. We are a long way from a time when a document's permissions can be embedded at the file level, traveling with the document no matter where it is sent. Ideally, someday your document destruction and retention policy will enforce itself, no matter where the documents are stored.
Another problem, though, with trying to automate document destruction policies is that no uniform standards exist for managing the lifecycle of documents and electronic data. Policies must be tailored to the unique business needs of each organization and its regulatory requirements. And because of the Sarbanes-Oxley Act, intentional document destruction is now a process that must be carefully monitored.
Despite the fact that the enforcement of document retention policies can't be handled by technology alone, the destruction process does bring real benefits: preserving the storage space on the network, on desktops and on backup media. Document retention also optimizes network and search performance and lessens the chance of having information used against an organization in lawsuits.
The period of time for storing business records should be determined by a retention schedule that takes business concerns and the requirements of federal and state regulations into consideration. Detailed logs of all destroyed documents and their exact data should be maintained. When getting rid of documents, be sure that the destruction method renders the information unusable and unrecoverable. Finally, don't just allow anyone to destroy your records. Payroll information, for example, or documents relating to labor relations or legal affairs, should not be entrusted to lower-level employees. If you use third-party contractors, make sure you understand the service level agreement and how they will ensure the security of your documents during the destruction process.
Dig deeper on Sarbanes-Oxley Act
Related Q&A from Michael Cobb
Do you know some of the best third-party patch deployment tools? See expert Michael Cobb's recommendations on which tools would work best for your ...continue reading
Users in the enterprise may unknowingly be exposed to 'Gchat' security risks. Expert Michael Cobb discusses Internet application security best ...continue reading
Today's powerful smartphones can sometimes spread viruses to the corporate network. Learn how it can happen and how to prevent it.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.