Microsoft Exchange hosting services have many advantages, but you need to ensure your service provider meets some important requirements before moving your email system to the cloud.
Make sure these five important areas are covered in your hosted Exchange service level agreement (SLA):
1. Mailbox storage: Plan for mailbox storage according to the maximum storage requirements per user. This should include primary mailboxes, archives and recoverable objects. Archives are often stored on lower-tiered storage, so factor that in when negotiating unit costs. You shouldn’t pay tier 1 rates if you’re using a combination of storage types..
Also, make sure there is sufficient geographic distribution of redundant email data copies. Redundant data in a single location mitigates the risk of server or storage array failure, but not data center-scale catastrophes. Additionally, storage utilization reports should include actual usage to accurately assess your capacity needs.
2. Email archiving: Exchange Server 2010 lets you implement personal archive mailboxes. Unlike traditional archives, these are owned by end users. User-managed archives have their place, but you may want a combination of both user archive mailboxes and traditional archives. Make sure you provider supports your archiving strategy.
3. Email retention policies: You should retain control over your archive and delete policies; these cover email messages as well as other Exchange objects. Exchange Server lets you specify rules that define when an object is copied to an archive or deleted within your environment.
Your SLA should ensure that your retention policies are enforced across all copies of your data, including redundant copies for failover and backup tapes for disaster recovery. Also, consider how your policies may change over time. If business requirements dictate an extension of the retention period, you should be able to modify your retention rules to estimate the impact on your current storage setup.
4. Security and compliance: Security is one of the most challenging aspects of email management, so make sure your SLA defines your expectations for mitigating common risks. Hosted Exchange services let you delegate responsibility for design decisions, but when it comes to security, it pays to know -- and require -- specific implementation details.
You’ll certainly receive antivirus scans on incoming objects, but you should also ensure that malware detection procedures are sufficient. Does your hosted Exchange provider use an in-house anti-malware system or a third-party service? If it’s an in-house product, how are the databases and behavioral detection methods updated? How are malicious links detected? Are whitelists and blacklists available to grant access to or block traffic from known malicious servers? Ideally, malicious content is filtered before it ever reaches your Exchange server, reducing the chance that it infects your users or network.
Consider your outbound security needs. Do you really want confidential strategy documents emailed to an executive’s private email account? Can a disgruntled employee email a sales contact list to a potential future employer?
Make sure your SLA also includes data-loss prevention measures. Can your hosted Exchange provider scan outgoing messages according to rules you specify? For example, you should be able to block messages with social security or credit card numbers. Simply put, defining your own patterns will help handle data-loss requirements that are specific to your business.
Reporting is crucial here as well. You should always have access to malware reports, content that has been blocked in outgoing mail, remediation methods and more. You also need to demonstrate proper compliance if you find yourself subject to any government or industry regulations.
5. E-discovery: You never want to be on the wrong side of an e-discovery judgment in court. Mishandling of electronic documents, including email messages, have led to findings of gross negligence and sizeable judgments against businesses. Your Exchange hosting provider is your partner in the e-discovery process, so the right applications must be in place to meet your needs.
E-discovery can prove time consuming, so evaluate the tools your provider supports. Make certain it has comprehensive search tools and gives you the ability to tag email messages, documents and other objects. It should also support e-discovery workflow.
Define the minimal set of search, processing and extraction features your company requires. Remember that email e-discovery may be done in conjunction with e-discovery on your SharePoint server and other document repositories, so you must be able to consolidate documents from multiple systems.
The five areas covered in this tip don’t cover everything you’ll need in an SLA, but they’re a good start.
ABOUT THE AUTHOR
Dan Sullivan is a technology writer and analyst with Concentrated Technology, LLC.