Not surprisingly, a growing number of companies are seeking systems that help them live with the new realities. "Without a doubt, compliance is putting a new onus on IT and organizations in general to ensure the integrity of all their information, and e-mail is a key piece of that," says Julie Rahal Marobella, a senior research analyst at IDC, a technology consulting company in Framingham, Mass. She estimates the market for e-mail archiving applications totaled $180 million in 2004 and sees it growing at an annual rate of more than 50% through 2008.

Financial services companies were early adopters of cutting-edge e-mail management systems in response to regulations from the SEC and the NASD. Now other regulations, like the Sarbanes-Oxley Act, have made nonfinancial companies interested in e-mail archiving systems as well. Marobella notes the emphasis on proper controls and documentation in Sections 404 and 302 of Sarbanes-Oxley: "Part of that is ensuring the integrity of all your information across all your systems."

While regulations like Sarbanes-Oxley are pushing companies to save more information, "no one is sure how much information needs to be retained," says Cass Brewer, editorial and research director at the IT Compliance Institute. "Nobody wants to retain information that could be used against them in a court of law. But they want to retain information that documents processes and is necessary for them to comply with critical regulations like Sarbanes-Oxley."

Vendors and analysts say that a company thinking about implementing e-mail storage first needs to assemble all the interested parties, including legal and IT, to set a policy on which e-mails should be saved and for how long. "A lot of times I believe what companies are doing in response to Sarbanes-Oxley–because what they need to store isn't defined by law–[is] just storing everything," Brewer says. "It's a headache in terms of storage and a headache in terms of retrieval. The more they can find out about and methodically index the e-mails they're storing, the better off they're going to be in terms of being able to meet compliance demands if the regulators come knocking at the door."

So what features should a company look for when it considers e-mail archiving software? Since regulatory requirements tend to talk about capturing messages from certain groups of employees, companies need a system that can define groups of workers and apply specific policies to each group, like the length of time its e-mails should be retained, says George Symons, chief technology officer for information at EMC Corp. The software should also index the messages, so that companies can find specific information if necessary, and it should provide an audit trail, Symons says.

Mike Gundling, senior vice president of product management at iLumin Software Services Inc. of Reston, Va., says the storage medium is important. The best choice is a platform or disk that does not allow alterations after e-mails have been stored, he says, a feature known in the industry as WORM–standing for write once, read many. "Backup tapes are a poor solution compared to a large, scalable magnetic WORM solution," he says. "It's a much stronger solution when you have a storage medium that prevents [e-mail] physically from being altered."

Frederik Soendergaard-Jensen, business unit executive for risk and compliance at IBM Americas, says that since companies want to be able to access stored e-mails for many years to come, they should consider whether technology is proprietary or based on open standards. "If you have a document stored 10 years ago in a proprietary format, you might have a hard time seeing it," he says.

THE COST OF DISCOVERY

E-mail archiving systems are sold for a licensing fee that ranges from $10 to $50 per user, as well as annual maintenance fees. Providers argue that the software provides customers with a number of offsetting savings, including lower storage costs. Instead of keeping lots of e-mails on an Exchange server, systems move older e-mails to cheaper long-term storage. The lighter load on the e-mail server means backup goes more quickly and employees waste less time clearing out old e-mails. The systems also cut the amount of information stored by eliminating duplication. If an executive sends a 20-megabyte PowerPoint presentation to 10 people, the system recognizes that all 10 attachments are identical and stores the presentation only once.

But the biggest savings occur if a company has to produce certain e-mails at the request of regulators or as the result of a lawsuit. "The cost of litigation is a killer right now," says EMC's Symons. "When you're asked to find all the messages for this set of people pertaining to this subject over this period of time, that can be a $1 million request."

Companies that save old e-mails on magnetic tapes may have to pay an electronic data discovery company to reload the information on hundreds of tapes onto a computer and search through it to come up with the old e-mails. ILumin's Gundling estimates that a company with 60 gigabytes of e-mail stored that implemented e-mail archiving in response to a request to search its backup tapes for seven employees' e-mails for a three-month period would enjoy initial savings of $30,000, and would save $100,000 for each future litigation event.

Chu Abad, vice president of information technology at Seattle Northwest Securities Corp., an investment banking firm in Washington state, has used the Assentor software now marketed by iLumin since 1999. Abad argues that it's impossible to calculate a return on investment on e-mail management software that is mandated by regulators. Avoiding "the fines and financial hits that you're going to get if you are audited and found not in compliance, that's your ROI," he says.