Barry Murphy - Mimosa Systems, Inc.

Enterprise eDiscovery?

2008-08-15T06:44:00.001-07:00

I awoke this morning to an interesting blog posting from a guy I respect a lot - Aaref Hilaly of Clearwell Systems. He's commenting on the IBM announcement of its eDiscovery Manager. Aaref's post astutely points out the IBM capabilities as well as product gaps (such as review, tagging, and analysis - conveniently enough, exactly the things that Clearwell provides…of course, I don't begrudge a vendor conveniently taking advantage of an opportunity to promote itself; after all, I work for a technology vendor).

Aaref's point is ultimately that IBM entering the market is significant because it's a sign that large software vendors take the eDiscovery market seriously. Nothing wrong with that argument at all. But, my opinion is that the announcement is just a sign on the road rather than some significant event. After all, IBM has had all the capabilities to create an eDiscovery solution for years, but has waited until now to make an announcement. And, as far as I know, there is no real eDiscovery expertise in IBM Global Services (and what a consulting opportunity there is in the eDiscovery market).

What I think is that IBM is letting the eDiscovery market know that it's coming. As leverage, IBM has "built" its own solution. But, if history is any lesson, IBM will buy several smaller vendors within the next two years. Looking back at the ECM market, IBM did the same thing - even as it built out its own capabilities, the software giant acquired point solutions like web content management and records management to roll into its own suite.

In theory, the IBM offering is the answer to the eDiscovery problem, offering a solution to manage all kinds of content. But in the real world where the rubber meets the road, best-of-breed point solutions are creating real value for organizations. Even Fortune 500 companies aren't ready to implement enterprise-wide retention initiatives; rather, they attack information management according to the most burning pain points (typically email and other user-generated content). To think that any organization is ready to deploy a single infrastructure for total information management today is to ignore the realities on the ground.

We should applaud IBM for entering the market and recognizing the need organizations have to decrease eDiscovery costs and risks. I don't think this entry will fundamentally change the market over the next year, but I do think this signals that IBM is serious about the market. It will be interesting to watch what kinds of acquisitions Big Blue makes to build out more of a best-of-breed portfolio.

The Power of Next-Generation Archiving Continues to Amaze

2008-08-04T08:45:00.001-07:00

Even before I began working for an integrated content archiving software provider, I was well aware of the fact that archiving software provides benefits across several spectrums. There's saving storage costs by moving information off expensive production storage; there's eDiscovery savings and risk mitigation by proactively retaining and disposing of information according to policy; and there's the end-user productivity benefit of allowing workers to save as much information as they need without having to create PSTs or figure other work-arounds to get past quotas. All of these benefits are huge, but there is so much more to the story.

Quick background to set some context here - I come from the world of ECM and records management. I began to study eDiscovery from that perspective, thus I thought of the benefits of proactively managing information from the point of view of a records manager or a General Counsel. And, yes, these folks really care about archiving and the benefits is can provide. However, these folks are less likely to want to dig under the hood of the archive software and see what truly differentiates one from another. And, I was no different…I was so impressed with all the benefits that archiving could provide, it almost didn't matter to me that all the differentiation is under the hood.

What's changed for me since coming to work at Mimosa is that I know talk to way more IT operations and infrastructures pros than I ever did before. These folks want their records managers and General Counsels to get the legal and risk mitigation of the archive solution. But, these folks also have to deal with many things that records managers and General Counsels never have to think about. Ask a GC what IOPS is I guarantee you won't get the right answer. But, input-output per second (IOPS) on an Exchange server is an extremely important metric. The more IOPS on your server, the harder it is to manage and scale. And, first-gen archiving solutions rely on capture mechanisms like MAPI and Journaling, both of which can increase IOPS up to 50%. Once you take that increase into account, the benefits of archiving start to look less glamorous.

And so, I'm back to the title of this post. Mimosa is the only next-generation archiving solution that capture content with zero production system footprint. No increase to IOPS, no agents on Exchange servers. Mimosa captures a full compliance copy of all Exchange data (including those things journaling can't get like calendar items, task, item histories, etc.) and then uses "Smart Extract" technology to archive any information that meets an organization's archiving policy. Oh, and by the way, because Mimosa uses "continuous application shadowing" (using transaction logs from Exchange to be replayed into a shadow database, from which information is archived), the system also offers completely integrated recover and optional DR. Important? Go ask any message administrator that has had to remount the last full tape backup, plus any incrementals, in order to recover a mailbox. My money says they will take Mimosa's point-in-time recovery capabilities that have the mailbox back in a matter of minutes instead of spending a full day trying to restore a mailbox.

It's part of what I love about the job - getting a new perspective on the benefits of archiving. And, learning the importance of next-generation archiving because of things like integrated recovery. Archiving has always killed multiple birds with one stone…Mimosa just keeps adding more and more birds to the repertoire…and it's fun to watch.

Don't Forget About Storage Costs

2008-07-21T06:38:00.001-07:00

I can't tell you the number of times I've been in a meeting where the issue of storage costs comes up. What always surprises me is the laissez-faire attitude toward storage costs…"Storage is cheap and getting cheaper" some businessperson will say. And, for the most part, everyone else just nods their heads. It's the easy way to dodge a tough issue. Who wants to argue with the truth; in fact, the per GB cost of storage is decreasing and will continue to do so. But, what no one talks about is that the amount of information being created that needs to be stored is growing exponentially, and probably at a larger clip than the decrease in storage costs. Thus, in relative terms, the cost of storing information continues to be the same, if not more, despite lower storage costs - especially for all those organizations still sadly stuck in the "retain everything" mode.

Talk to your infrastructure and operations professionals…these folks know that it costs big money to store all an organization's information assets. These are the folks that roll their eyes when they hear everyone else talk about how cheap storage is getting. And, these are the folks that must bend over backwards when that discovery request comes in and forces them to restore the cheap backup tapes (at close to $2,500 per tape), or gather the 100 GB of information off cheap storage (which then has to be processed at a cost of about $2,000 per GB). For these professionals, the cost of cheap storage comes in lost man-hours; for their organizations, the cost of cheap storage is born in too expensive eDiscovery.

I won't argue that storage, in general, is being commoditized. But, that doesn't mean we can just shrug off the cost. Because we continue to create more and more information, that relative cost of storage stays the same or rises. The solution lies in creating policies that allow for the disposition of information and putting in place an infrastructure that allows an organizations to put the information it keeps on the cheapest storage possible, get rid of what it doesn't need, and have the tools in place to conduct efficient eDiscovery.

The eDiscovery Juggernaut Rolls into Canada

2008-07-09T06:01:00.001-07:00

Think the FRCP eDiscovery driver is limited to the United States? Think again! New proposed legislation in Canada would require "firms keep their records - including electronic messages - in a durable form that can be 'promptly' provided to regulators if a record is requested within two years of its creation.

After two years, requested records must be delivered in a 'reasonable period of time.' In fact, NI 31-103 requires firms to keep some records for seven years after the departure of a client." Wow - sounds eerily similar the US's FRCPs.

Now, the reality is that many of Canada's largest institutions have taken eDiscovery seriously for quite some time. After all, those organizations do a fair amount of business either in the US or with US partners - and they feel it's better to be safe than sorry. What this new proposed legislation means is that smaller organizations will be compelled to think seriously about the retention and discovery of their electronic communications. Good news once again for the email archiving market.

Skeptics out there will say that Canada has mirrored the US and that this is no big deal. I would argue that this proposed legislation is a good example of yet another country telling businesses, "you better get your arms around this electronic communication thing and not hide behind excuses that it's inaccessible or that it's too expensive to restore it from backup tapes." The onus is squarely on the organization - anyone who doesn't get that has their head in the sand.

As we look worldwide, it's not out of the realm of possibility that more and more countries will adopt similar legislation. Surely, many countries will have cultural differences and want to protect the privacy of individuals. All that means is that organizations (especially those that do business in multiple countries) will need technology that allows them to set retention policies and access controls at a very granular level. The need for archiving and eDiscovery tools will only be heightened by geographic differences.

Years ago, when the FRCP amendments went into effect, the collective industry wondered what the global effect would be. Well, the answers are starting to come in - and it looks like governments will have stringent requirements. Don't be an ostrich - start planning your infrastructure to manage electronic communications today!

SaaS vs. On-premise archiving - the debate rages

2008-07-03T06:57:00.001-07:00

During my industry analyst days, I got some perfunctory inquiries on hosted vs. on-premise email archiving. There was clearly some interest in software-as-a-service (SaaS), but there wasn't much of a debate - on-premise archiving was the way to go for 85% of clients. Why? Mainly because they wanted mailbox management for end-user access to email, fast query times for eDiscovery, and the ability to customize the software to their specific needs.

Disclaimer: I work for an on-premise archiving vendor, so I technically am biased. However, I believe SaaS does have future in the archiving market…it's just not pragmatic today for organizations that want to facilitate end-user access and eDiscovery.

As Nick Mehta (CEO of LiveOffice and a guy I highly respect) points out in his blog, SaaS archiving does provide the benefit of being up and running faster and cheaper than on-premise archiving. But, there are many functions that SaaS archiving does not provide today:

Opportunity to develop internal expertise for advanced queries
Mailbox management
Integrated content archive (e.g. file system content, SharePoint)
Integrated disaster recovery
Offline access to mail for knowledge workers
Plus, hosted email archiving vendors have a difficult time meeting SLAs (this is know first-hand from my industry analyst experience - it was a huge complaint of users), rely on journaling which puts a huge strain on the email server, and suffer from poor query speeds (some eDiscovery searches take hours to run). Thus, for organizations that need to manage eDiscovery and end-user access to mail, SaaS archiving does not make sense today.
What does make sense is a hybrid solution, where an on-premise archiving product provides mailbox management, message extension, and eDiscovery while the hosted solution becomes a "tier" of storage where mail subject to compliance (e.g. has to be held by a 3rd party) or very long-term retention is sent to the hosted archive.
As always, your thoughts are welcome…SaaS archiving is an emerging market that will certainly continue to cross paths with the on-premise market. At the very least, it will be fun to watch things play out.
Happy 4th of July to all!

Best-of-Breed or All-in-One Solution for eDiscovery?

2008-07-01T15:15:00.001-07:00

Years ago, those of us in the information management industry used to argue about whether best-of-breed solutions for web content management, document management, records management, and document imaging were better than enterprise content management (ECM) suites. After lots of consolidation, it would appear that the "suite" approach won, but the reality is that most organizations still use best-of-breed products (even if they bought a full ECM suite). Sometimes, bigger isn't always better.

A similar debate rages in the eDiscovery world. There are providers that appear to be a comprehensive, one-stop-shop for all things eDiscovery. While some of the tools out there can actually do incredible things, I believe that a comprehensive solution that addresses all eDiscovery needs is a myth. We vendors are certainly trying to do the right things and provide good products - no question about it. But, customers need best-of-breed solutions in specific areas and will need to mix and match those solutions together based on their (usually very) unique situation.

I find that most large enterprise organizations understand this fairly well. There are times that I sense the overall market beginning to buy into the idea of an "all-in-one" solution (and, in theory, that would provide great value). However, all organizations should keep in mind that today's "comprehensive" solutions:

1.Routinely fail to deliver the promise of true integration and holistic view into every silo of content

2.Decrease the ability to develop and retain requisite technical skills in house to design and operate these solutions

3.Increase cost and risk in the end, and diminish leverage in negotiating software licenses

We've heard this story before, and we'll continue to hear it as consolidation rumors heat up in the eDiscovery market. If I'm a CIO or legal officer at an organization today, I wouldn't put all my eggs in any one vendor's basket. My priorities would be creating pragmatic, role-based retention policies; addressing proactive preservation of high-volume content (read: nightmarish for eDiscovery) like emails, file system content, and desktop/laptop content; and creating the ability to do early-case assessment with a review tool. Your thoughts are welcome…let me know if you agree / disagree.

Making Sense of the Chatter

2008-06-25T22:32:00.001-07:00

It's been quite a couple of weeks in the eDiscovery world. FTI bought Attenex for $88 million. EED buys Daticon (anyone else notice that the press release for that didn't have one mention of Xiotech, the company that sold Daticon? I called it back in my analyst days - a mid-tier storage provider should not own an eDiscovery service bureau). Steve D'Alencon leaves Kazeon to take over as CMO of CaseCentral. And, my phone rang several times with contacts from the venture capital world checking in for opinions on companies they are considering investments in. Why all the activity? I get the sense that the eDiscovery market is again at a precipice. Hype began around the time of the amendments to the FRCP - and market size projections have been high - I should know, I did one of them ;-)

Are the market projections wrong? No, and in fact, I would say the market projections have been conservative. What's been delaying the near-term growth is, first and foremost, the immaturity of the enterprise market when it comes to eDiscovery. For those of us in the market, the ignorance is hard to fathom. Yet, at meeting after meeting, I still hear legal and IT on opposite sides of the fence (and often ignoring the business people that know how best to manage information).

But, the FRCPs are powerful - and they are driving change. We've been waiting and waiting and waiting for the market to pop. And now, the first signs of a boil emerge. We now sit waiting for the next shoe to drop, and everyone's got an opinion on when and which shoe it will be. I'm interested in hearing yours…

In the meantime, while all the exciting activity takes place in vendor land - you organizations need pragmatic solutions that address today's pain and can evolve to be a long-term solution. Let me know how I can help you plan that out.

ILM - myth or reality?

2008-06-12T05:26:00.001-07:00

The term Information Lifecycle Management (ILM) has been around for quite some time. Wikipedia defines it as "the practice of applying certain policies to the effective management of information throughout its useful life. This practice has been used by Records and Information Management (RIM) Professionals for over three decades and had its basis in the management of information in paper or other physical forms (microfilm, negatives, photographs, audio or video recordings and other assets)."

In recent years, the term ILM was somewhat coopted by EMC to really have more of a storage connotation - basically the movement of information from tier to tier of storage (high-end storage at the beginning of its lifecycle when fast access is critical to low-end storage at the end of the lifecycle when the information likely won't be accessed).

But since the ILM term was coined, the world has changed significantly. The volume of digital content has exploded, with no end to its growth in site. Instead of formal documents, users now create small bits of frequently-shared information. This creates a challenge in executing ILM…it becomes way too complicated.

Meanwhile, the FRCP amendments and compliance regulations put organizations on the hook to do their best to manage the lifecycle of all electronically stored information within the enterprise. So, organizations face a Catch-22 - practice ILM or face huge sanctions, right? Well, the outlook is not as dreary as all that. First, the FRCPs call for reasonable and good faith efforts. Is it reasonable to have a 100-step ILM process for every email sent and received within the organization? No. What is reasonable is to have role-based retention policies in place as a good start. Organizations can do that in their archive. For messages that need more advanced records management, orgs can integrate their RM app to manage the messages in-place within the archive. But, the reality is that basic retention management is going to be enough in 95% of all cases (if not 100% of non-government organizations). That's why so many organizations have deployed archiving, while only 12% or so have rolled out enterprise-wide records management apps (an RM app would be a pre-requisite to practicing effective ILM).

So, is ILM a myth or reality? Pragmatically, it's a myth. But, if you take it down to basic retention management, it can become a reality. Take a good, hard look in the mirror; get your IT staff and legal team together with LOBs and make the right decision - implement role-based retention management for that high-risk content (email, instant messages, file system content), and then start to investigate broader records management as your policies evolve.

More consolidation in eDiscovery space

2008-06-11T05:46:00.001-07:00

We all knew it was coming - there are so many vendors out there that message to eDiscovery that there was bound to be a big round of consolidation. Some shots had already been fired over the bow - Kroll bought Engenium, Autonomy bough Zantaz (which had previously bought SteelPoint), Seagate bought MetaLINCS, and Iron Mountain bought Stratify. Yesterday, it was announced that FTI Consulting bought Attenex. To me, this announcement is notable because Attenex has been a brand associated with the new guard of eDiscovery. The company's approach to analytics-driven review really opened eyes to the money that can be saved in the review process by using things like concept search and visual analytics. In that sense, the company was a trailblazer.

Attenex primarily went to market through service providers - and FTI was one of those channel partners. I would have to believe that the acquisition will negatively affect other channel relationships. But, the real win here is for FTI, who gets good analytics to add to its Ringtail review platform (assuming it integrates the Ringtail and Attenex technology) and gets it at a nice price - in my analyst days, I expected Attenex to sell for $150M (versus the $88M that FTI paid).

Now, the analytic-driven review market has only two main pure-plays left - Clearwell and Recommind. It's only a matter of time before they get snapped up (HP, IBM?). Meanwhile, archiving companies like Mimosa have the pleasure of partnering with these review players so that we can give our customers the option to seamlessly get data into these platforms without any processing costs (watch for more from Mimosa on this soon).

Watching the consolidation is fun - what do you think is next? Let me know...

Allowing for free-flowing information while managing compliance / eDiscovery

2008-06-03T06:40:00.001-07:00

I'm sitting in a Microsoft Exchange seminar as I type, watching all of the things that information workers can do in their Outlook clients with Exchange 2007. It's fascinating to see what is possible in terms of collaboration through presence awareness, unified communications, and VOIP. What strikes me most is the notion of complete freedom of information sharing. With that freedom, we can increase the velocity at which information travels between the people that need to utilize it. While this is clearly a step forward, someone needs to raise the caution flag, and I guess I'm just the person to do it. Now, I'm not saying that utilizing these technologies is wrong; on the contrary, I believe that rolling these out to information-intensive workers is critical. But, let's learn from the past and make sure we have systems in place to manage that information (in a way that continues to let it flow freely).

Microsoft partners like Mimosa have built solutions specifically to do just that - allow organizations to best use Microsoft's information worker solutions, but do so in a way that also manages for compliance, eDiscovery readiness, and leaves as little footprint on your Microsoft systems as possible. One of the hotly debated topics is how much of this advanced Microsoft technology, e.g. Unified Communications, is currently being used. I'd love to hear from you - what do you think? Is UCC a concern for now, or for a year or two down the road? How are you approaching managing the user-generated content in your organization for compliance and eDiscovery?

Hit me up at bmurphy@mimosasystems.com

From email archiving to eDiscovery to IP Loss Prevention

2008-05-28T06:18:00.000-07:00

I came across an interesting blog entry here at eWeek. Looks like my former employer (and still good friend) Forrester Research has released interesting data around email security. What does that have to do with email archiving and eDiscovery, you might ask. Well, maybe not a whole lot at this very second, but there is a convergence between archiving and security - one that will heat up in 2009.

The data point mentioned in the eWeek blog is that 41% of companies are monitoring employee email, a 2% increase over the previous year. The blogger goes on to make a great point of her own - asking why companies would pay people to read the emails when technology like email archiving and eDiscovery can do it? Great question, but the answer may not be what you are expecting me to say…we still need people to look at those emails. In reality, it's the combination of technology and people that will ultimately create good content governance.

Today, technology alone cannot tell you if an employee is violating and email policy (or, just as importantly, a network file share policy like no price lists on public shares). But, it can proactively alert a supervisor that there is a potential violation and have the supervisor review the content in question. At Mimosa, our Content Monitoring Option is what serves this purpose. It allows organizations to create alerts across all archived content (e.g. email and file system) so that supervisors can govern that policy is followed.

NOTE: the first step is to make sure you actually have policies; too many organizations do not. As we continue to become an economy driven by information in the form of intellectual property (IP), technology to help us ensure we don't lose it (or let competitors get it) will become increasingly important. Because email is the communication method of choice, monitoring it is key - why not do that with the same platform you use for archiving and eDiscovery? It's cost-effective and it's doable - it's a platform, after all.

My call: within 2 years, you will see the same percentage of companies using email archiving for both eDiscovery and content governance. Let me know if you agree.

Retention Re-visted

2008-05-20T15:28:00.000-07:00

I admit it - I simply cannot get retention management off my mind. My problem is this: as a former analyst covering records management software, I know well that organizations wan to deploy RM systems to help ensure compliance and make eDiscovery more manageable. And yet, with each passing day and each meeting I attend, enterprise-wide RM software looks more and more like overkill. Don't get me wrong - some of the RM software out there represents genius thinking and advanced functionality. But, most of the organizations out there simply are not ready to deploy sophisticated retention management software.

Proof positive comes in the form of results from the 2007 Electronic Records Management Survey (conducted by Cohasset Associates and co-sponsored by AIIM and ARMA). The survey polled close to 1,600 records managers at organizations - these are folks intimately familiar with the retention policies and any associated enforcement/automation in today's companies. Some of the numbers are staggering:

- 35% of respondents evaluate their records management programs as marginal or fair
- 36% of respondents either do not regularly adhere to their retention schedules, or do so only as time permits
- 40% of respondents do not include electronic records in their retention schedules (these folks either have their heads in the sand and have never heard of the FRCPs or have unlimited storage budgets and are keeping things forever)
- Records managers still trail IT (47% to 56%, respectively) in terms of having responsibility for defining the retention requirements for archival and backup media (last I checked, most IT folks don't have the legal qualifications to make retention decisions…and I don't know one IT person that would want that responsibility).

I could go on and on listing numbers…no matter where I stop, the end result is the same - depressing. Organizations continue to press down the path of full-blown, enterprise-wide records management when the reality is that most can't even figure out how to do simple retention policies that could be enforceable by technology. This brings me back to a point I've made in an early post - a role-based approach to retention is an excellent starting point. For example, keep all content for finance employees manager-level and higher for seven years. Boom - reasonable, enforceable, and automatable. Really, how many organizations require a DoD-certified records repository? And, of those that do, how many can prove they are adhering to their retention schedules for all information? My bet - none. It's time to get real about retention - start simple and evolve. But, more importantly, start now.

Interesting Times in the eDiscovery Market

2008-05-14T10:46:00.000-07:00

Lots of chatter on the recent Kazeon / Attenex announcement that promises eDiscovery processing costs as low as $4.30 per Gigabyte. Many experienced eDiscovery folks have cried foul, citing the intricate details of eDiscovery processing and the inherent costs. C'mon folks - somewhere the twain shall meet. eDiscovery processing costs are going to come down no matter what. The technology for processing is getting better and, more importantly, organizations are starting to proactively manage much of their discoverable information (though not enough for my liking). How fast we go from $2,000 per GB for processing to less than $5 per GB remains to be seen. That debate, frankly, takes us away from the more important issues to be solve. Why? Because everyone is focused on the ability to collect and find legacy information that is traditionally unmanaged. What the focus should be on is proactively managing this information. That's right - setting retention policies, getting rid of non-necessary content; these types of actions are what will eventually lead to the elimination of processing fees. But, the legacy data messes that exist within organizations will keep processing vendors busy for quite some time.

At the end of the day, organizations need to realize what they can change and what they can't. They can proactively archive content, set retention policies, and be sure to get rid of what they don't need in order to directly decrease the cost of eDiscovery. They can begin to address legacy content messes only after they get an infrastructure in place - typically by migrating legacy content into their archive and then setting retention. Let's not take our eyes of this prize by arguing over the true cost of today's processing activities.

Can eDiscovery Be a Driver for Culture Change?

2008-05-09T06:52:00.001-07:00

I've been involved in several recent debates about whether organizations should do whatever it takes to allow workers to create and share information assets or whether strict limitations should be put on information usage. Theoretically (especially in an information-driven economy), organizations should strive to provide an infrastructure that allows users to easily create, find, share, collaborate on, publish, and transact information. That's the theory behind what Forrester Research calls the "Information Workplace."

In practice, though, there are barriers to providing such a free infrastructure. First, from a cost perspective, it' s not cheap to put such an infrastructure in place. Over the last decade, many organizations turned to enterprise content management (ECM) suites in the hopes of creating an environment where information could flow freely. But, these tools proved to be non-user friendly - only 20% of ECM licenses sold ever get deployed (that's quite a sunk cost).

So, if much of the information throughout an organization is not within a content management system, then a serious problem exists - the fact that the information is not managed means it is difficult to find. Because of eDiscovery, finding, processing, and reviewing this information could cost millions of dollars. As I've mentioned before, many organizations turn to archiving solutions to get many of the high-volume sources of information under some kind of management control. But, the problem that arises next is dealing with the culture of an organization where employees are used to keeping things like emails as long as they want in the format they want (e.g. PST).

Thus, IT is often left being the scapegoat for all information related problems - users blame IT when email is disposed of according to company policy (saying they've lost important knowledge assets), and legal comes down hard on IT when all potentially responsive data needs to be collected for eDiscovery (usually, IT cannot do this quickly enough, or cost-effectively enough, to satisfy legal).

Savvy IT folks (and the legal and compliance officers they work closely with) are allowing the issues involved with eDiscovery to help them create culture change within their organizations. Getting rid of email is good for everyone - and if users want to keep things, there are folders within the archive they can classify those emails to. Hopefully, all these systems will be able to do this automatically someday, but until that distant-future becomes reality, it's good to give users some skin in the game ("classify this or you will lose it.")

And, if you are worried that users will cringe at the thought of Big Brother monitoring their information usage, just remember that the information they create and use while in the employ of the organization is not theirs - the organization bears the liability (at least in the US). And we know from cases like Chevron (where male employees sent around emails about why beer is better than women) that employees are not always going to adhere to usage policies - better to be safe than sorry. Better to monitor and proactively enforce than be caught red-handed after the fact and deal with sanctions and other fall out.

Mimosa Announces File System Archiving

2008-05-06T07:24:00.000-07:00

It's always exciting to be part of bringing something new and valuable to market. When I tell my friends about Mimosa's new File System Archiving (FSA) offering, they tend to roll their eyes and yawn. But, none of my friends are IT Operations folks dealing with soaring storage costs and overflowing file systems; and, none of them are legal or compliance officers worried about finding and reviewing the terabytes of data that sit out on file shares.

Now, when I talk to potential customers about the FSA offering, I get their interest immediately. Perhaps that makes us all official geeks, but having dealt with these folks for a long time as an analyst at Forrester, I know their pain. First, they wanted to get email under control - and many did via email archiving. The next logical step was to corral free-range files, but the first-generation file archiving products presented some challenges. First, these products had trouble managing the movement of stub files (the stubs being the smaller objects that replace the full versions on primary storage with a pointer to the full version). Second, these products restored files back to the file system when users accessed the file (many call this the "ping-pong" effect). Both of these problems kept the adoption of file system archiving low, even though there was great customer interest in a consolidated archive of messages and file system content.

Mimosa's NearPoint FSA offers a solution that gets past these traditional problems - no more "follow the stub" nightmares during backup routines and no restoring files to the server when users access them (because then those files have to be archived again). IT Ops can love the solution because it saves storage costs with global deduplication across messages and file system content, plus any backup tape content that may have been imported to the archive. Legal, compliance, and records management can love the solution because it offers a single, unified archive in which to apply consistent retention policies, execute universal legal holds, and conduct eDiscovery searches in a single user interface. Mimosa's NearPoint FSA is truly the next-generation solution that solves real business problems. To me, it's got that rare combination of being both innovative and pragmatic.

As a former analyst, I'm a believer in 3rd party validation. See what some of the analysts had to say about Mimosa's FSA - both ESG and Taneja weigh in with their thoughts that you can find here.

It's great to be part of this new product launch and I'd love to hear your thoughts on it - feel free to post comments here or email me at bmurphy@mimosasystems.com.

Being THAT Guy...

2008-04-29T08:30:00.000-07:00

I'm down in Orlando this week for the Windows Connection Event. It's great to be talking with lots of Exchange administrators and IT folks that leverage Microsoft technologies and need strong Microsoft partners to extend those investments.

As is typical, I made a klutzy move in front of everyone…I went to pick up a glass to get a drink in the middle of the conference floor. My glass stuck to the one under it and, in an effort to pull mine away, I dropped the other one on the table and a loud crashing noise ensued followed by tiny chards of glass flying all over the place. And, given my Irish luck, the whole room happened to go quiet 1 second before the glass broke, so everyone in attendance turned to look at the fool who dropped the glass. Yes, I was THAT guy.

I only bring up this story because I felt like THAT guy throughout the whole conference…or should I say, it felt like Mimosa was THAT company. People kept coming to our booth and saying, "you're that company that does log shipping," or "you're the company that doesn't require journaling." It's been totally refreshing to hear people understanding the value proposition that Mimosa espouses - get a compliance copy of your Exchange environment, make it easily available to end users, and have it have zero impact on your Exchange server. The lights really go on when they realize that this approach is not only great for archiving, but for disaster recovery, too…and they can get both in one product.

With the evils of journaling and MAPI getting more and more exposed, I know I'll be hearing from more people, "you're the company that doesn't require journaling." And, I'll be happy to be THAT guy for once, not having to hide my head as I clean up broken glass ;-)

Practical Advice on Retention Management

2008-04-24T08:08:00.000-07:00

I was reading through the electronic version of AIIM's eDoc Magazine earlier this week - it's a valuable source of information with great articles and contributors. The latest issue has a lot of articles dealing with the issue of records management and, more broadly, retention management. The one thing missing, though, is a tutorial on how to create and implement a truly workable retention policy.

Now, implementing a records management strategy is difficult work - that's why the RM consultants can charge the big $$ for their services. The reality is that traditional RM frameworks don't work well in the world of digital information - the days of the 5,000+ category file plan are over (at least they should be). And yet, many organizations continue down the path of complicated retention schemes that prove to be impossible to actually enforce in any kind of automated or consistent manner. I remember a conversation with a company that spent million of dollars and 3 full years trying to come up with a records management scheme that would work. At the end of three years, the company gave up - the project had gone too deep and tried to boil the ocean. The results were sunk costs and an over-collection problem for eDiscovery (because the solution, when nothing else worked, was to keep everything).

With all the concern around eDiscovery, organizations need a practical way to conduct retention management that can be implemented quickly and successfully, and that has the flexibility to evolve. One methodology that I've seen work is to institute role-based retention. Most legal folks I talk to think this is a "reasonable" and "good faith" effort, and it can be straightforward for IT to implement. Roles can start off simple, e.g. executive team, finance, sales and retention can be set for each role. The beauty of the role-based retention strategy is that it is defensible, executable, and grow-able. Organizations can evolve their retention strategies to go beyond roles as necessary. For example, retention policies could start off as "5 years for all finance-related documents" and evolve to "5 years for all finance-related documents created by director-level and higher employees and 1 year for all finance documents created by manager-level and lower employees."

In my time as an analyst, more and more organizations chose archiving products as the first step in a role-based retention strategy. What these organizations wanted was a way to easily retain content with a solution that:

1. Doesn't drive infrastructure costs sky high - after all, the volume of digital information grows exponentially (thus, disposition of unnecessary information is critical)
2. Meets any compliance regulations (e.g. can keep copies of everything if needed and keep them immutable)
3. Meets user access needs (allows for seamless access)
4. Allows for retention policy evolution

Be careful on #4 here. Many of the products in the archiving space are not able to easily allow re-classification of content as retention policies evolve and change. One of the things I've really liked about Mimosa NearPoint is that it can (while also meeting #'s 1-3 above).

If you've got questions about role-based retention and how to get an initiative off the ground, I'd be happy to help. Just ping me at bmurphy@mimosasystems.com

eDiscovery - Own It!

2008-04-15T23:10:00.000-07:00

I often hear organizations ask: should eDiscovery be outsourced or handled internally? Well, unfortunately, the answer to that question depends on various factors - it's not a simple insource/outsource decision. One thing is for sure - every organization should "own" eDiscovery. That means decision-making belongs with the organization, not its law firm (though the law firm should be a strategic adviser). The way to think of it is that the organization owns the process of eDiscovery, and is ultimately responsible for process performance.

But, eDiscovery is a multi-faceted process; deciding what aspects to insource or outsource can be difficult and complex. However, using the EDRM framework (you can find more on this here) as a guide can certainly help:

Experience has proven to me that all organizations benefit from putting in place an infrastructure to proactively identify, preserve, and collect potentially responsive information. Most enterprises (I think of enterprises as 1K+ employees) create this infrastructure with on-premise software tools like records management and archiving. Why? Because it's not just legal making decisions on these tools or reaping the benefits. The infrastructure and operations staff saves on messaging system administration and storage costs; the compliance officer reduces risk; the information manager makes information access more efficient. Over time, organizations will be able to choose from on-premise, SaaS, or hybrid solutions - but for now, the important decision is to build that platform from which to enable eDiscovery.

Plus, achieving success in building this infrastructure will drastically reduce (or even eliminate) much of the processing costs involved with eDiscovery (and those processing costs have traditionally run at close to $2K per GB). On-premise tools for sophisticated review and analysis hold promise for early-case assessment, but have not gained huge traction within corporate legal offices. Hosted versions of these tools are gaining momentum, especially for large scale legal review when the law firm gets involved.

2008 will not be the year we see enterprises stand up and accept full responsibility for eDiscovery (you would be surprised how many still bury their heads in the sand). But, it is fast becoming the year that organizations solidify plans for proactive identification, preservation, and collection. My advice to any organization - get on the bus now or get left behind.

Why I Joined Mimosa Systems

2008-04-11T14:34:00.000-07:00

Much has been made of my decision to leave Forrester Research for a content archiving vendor. It's been interesting for me to follow the news, if only because it's part of the natural lifecycle for an industry analyst to join the ranks of a software vendor (and vice-versa). The analyst world is both interesting and rewarding, and Forrester was a great place to work. I learned much about the records management, content archiving, and eDiscovery solutions in the marketplace; I was able to interface with hundreds of organizations to learn the very real challenges associated with information retention and access; and I was able to develop a good sense for the chasm that exists between where we are now in terms of litigation readiness and where we need to be.

It's this last point that led me to the content archiving world directly. As an analyst, I could advise organizations of best practices and strategies to improve litigation readiness, but there was a level of depth that I could not get to. And, what was clear is that organizations have an extremely tough job ahead. I want to be part of the deeper solution - and content archiving is the first step that is both pragmatic (meaning it can have real, immediate impact) and a right step in the direction of "where we need to be."

The obvious question, then, is "why content archiving?" And, this is a good question - with enterprise content management (ECM), records management (RM), and enterprise search technology all offering to be the ultimate solution, why is content archiving the place to hang your hat? Well, all of the afore mentioned technologies offer theoretically good solutions to the information retention problem. But, this is where we need to loop back to pragmatism. ECM deployments are extremely broad and take years (think at least 3+) to fully implement - and historically, less than 20% of licenses sold have ever been deployed (that's a big sunk cost to swallow). RM requires that organizations have fully-developed policies governing all potential information sources; however, most organizations don't even have policies to govern the most-used information tools like email. Enterprise search is good at finding information across various repositories, but not at enforcing policy on it.

Content archiving can have a positive impact for organizations, and can do so immediately. First, there are the obvious benefits: storage optimization and system optimization (such as alleviating the burden on messaging servers with email archiving). The beauty of archiving, though, is that it kills multiple birds with one stone. Not only does it deliver optimization and reduced storage costs, but it also:

Makes information available seamlessly to end-users (say, via stubbing) without requiring them to manage quotas
Simplifies retention management by providing one administrative interface from which to manage retention policies on all content in the archive (say, from emails and file systems)
Eases the process of enforcing litigation hold (especially important given that email is the most-often requested form of electronically stored information)
Doesn't require an organization to have full-blown records management policies; that's right - organizations can comply with the FRCPs and have some simple (and consistently enforced) retention policies - and the content archiving solution is flexible, allowing organizations to change retention policies as they evolve.

I will certainly miss the analyst world and some of the breadth of learning that one can achieve in it. But, I am excited at the opportunity to get more depth with customers. I'm happy to be in the content archiving world and look forward to reporting on some of the success stories I see out there.