Regulations and audits have become a way of life for many security officers, especially those in the financial and healthcare industries. For example, the Gramm-Leach-Bliley Act (GLBA) requires banks and financial institutions to establish comprehensive security policies to safeguard customer data. Likewise, the Sarbanes-Oxley Act of 2002 requires all publicly held companies to establish and maintain internal controls over their financial reporting systems and ensure their effectiveness.

At the time these regulations were drafted, however, their far-reaching consequences weren't understood. The cost of non-compliance can be high ranging from a loss of company reputation, to prohibitive fines, to imprisonment. For employees, expectations of privacy have been forever altered. And yet, most compliance regulations don't provide the specifics needed to translate broad security mandates into day-to-day guidelines and procedures. If there was ever a formula for a headache, this was it. As a result, companies are only now coming to grips with what compliance means to their organizations. As IT makes its way forward in this wilderness, lessons have been learned. Here are some of them.

Follow the Framework
What's become clear is that when it comes to compliance, legislators are better at spelling out the end point they want to arrive at, rather than the road to get there. In particular, none of the information security or privacy regulations provide more than the broadest of guidelines when it comes to the nitty-gritty of drafting effective acceptable use policies (AUPs) in the organization. Indeed, while Congress may have set down the broad requirements, it will be the courts that, in the end, determine how the law applies to real companies under real circumstances. What does that mean to you? In essence, you must connect the dots yourself, tailoring the intent of the regulations to your specific business or industry, as well as special constraints and considerations and other facts of operational life. In doing so, you may find that you are describing policies that are specific not just to your industry, but your company. Two companies in the same industry with similar organizations may, in fact, have quite different policies depending on slight variations in how they do business. The best advice we can give you is to use externally validated frameworks as your guideposts, including ISO 17799, COBIT, which is most commonly used in relation to Sarbanes-Oxley, and the guidelines coming out of the National Institute for Standards and Technologies.

The E-Mail Retention Balancing Act
Some of the most eye-grabbing tales about compliance have to do with e-mail - how long to keep it, whether to filter it, what to do if it's subpoenaed. In some cases, government regulations mandate what needs to be retained and for how long - particularly in the financial and healthcare sectors. Otherwise, the choice is up to you, and, for most companies, the emerging conventional wisdom is to retain as long as necessary and not a day longer. This isn't about burying potential evidence; there are valid legal reasons that once a piece of correspondence isn't absolutely required, you should get rid of it. Not doing so has caused many companies, including Microsoft, major financial burdens.

And then there's the punishing cost of pulling the relevant documents up from a massive offline archive of correspondence. The number of e-mail messages generated in a week by even a mid-size company can number in the millions, and the cost of retrieval rises exponentially with the number of years retained. If you don't have the tools in place ahead of time, the cost of doing so in time to meet court-mandated deadlines can be extraordinarily expensive.

As a result, some companies are starting to filter correspondence up-front if possible - determining message content that in turn determines longevity at the time an e-mail is sent and received. For example, correspondence related to patient care may be retained for the life of the patient - if it has to do with diagnosis. Or it might be retained for a much shorter period - if it's related to billing. We may eventually see in the U.S. what some European countries already permit: an "opt-out" policy in which employees can mark a given piece of correspondence as personal, not business-related. The e-mail goes out and - not being business-related - is classified as such. European countries also tend to present more real-time policy reminders to employees when an activity is performed. In some environments, for example, each time a staffer sends an e-mail, a prompt message comes up as a reminder that the system is meant for business use only. Those reminders are also another way of demonstrating that a company is doing the right thing - proving that an individual knowingly violated corporate policy.

Whatever policy you set, remember that investigating agencies make a distinction between your written AUP and the de facto policy you actually follow. If, for example, you say that you retain e-mail for a year but your archive extends to three, the de facto retention policy is the one that may apply.

Webmail, IM'ing, and Webcams
During the early stages of regulatory compliance, companies turned their full attention to e-mail as the communications link between their internal staff and the outside world. In practice, however, the picture is a bit more complicated. When we first install our e-mail security tool at a customer site, employees who want to communicate privately switch over to a Web mail account such as Hotmail, Yahoo! Mail, or Google's Gmail. The shift is both immediate and predictable. And when those venues are covered, resourceful employees shift again - to instant messaging.

As a result, companies are now planning from the get-go to monitor traffic on their corporate e-mail accounts, over the full gamut of Web mail services, and on messaging services as well. The scope of scrutiny is wider, but the method is the same. Good compliance tools will look for key words and phrases that could signal trouble, sometimes using standardized templates that attempt to recognize a type of activity an individual is undertaking. Sometimes information in combination can raise a red flag. A medical group exchanging medical terms might not raise suspicion, but that combined with a customer ID number or a social security number may raise a red flag.

A good tool will also let management put restrictions on the kinds of files that can be uploaded and downloaded and consider the content of those as well. In the long run, the answer will be one of employee expectations. The new compliance rules all but mandate that there's no such thing as truly private correspondence on the corporate network. If you have something to say and don't want others to know what you are saying, say it somewhere else. All electronic communications leaving the company network should be viewed the same way. The acid test is would you say what you're communicating via e-mail, the Web, or IM if it was typed in a letter on company letterhead? The courts will certainly view it as having the same weight and remember that it's just as permanent - just because you delete something from an archive don't assume that the communications trail has disappeared. If it was sent to one or many others what was their retention policy?