lo ngại trong khu vực tư nhân bao gồm Đạo luật Sarbanes-Oxley, SEC Rules 17a-3 và 17a-4 (trong đó yêu cầu các nhà môi giới đại lý để tạo ra và giữ lại một số hồ sơ), Gramm-Leach-Bliley, và bảo hiểm y tế tính di động và trách nhiệm Act (HIPAA) . Khu vực công cộng là chủ đề Tự do của Đạo Luật Thông tin và quản lý an ninh | Email Compliance 671 concern in the private sector include Sarbanes-Oxley SEC Rules 17a-3 and 17a-4 which require broker-dealers to create and retain certain records Gramm-Leach-Bliley and the Health Insurance Portability and Accountability Act HIPAA . The public sector is subject to the Freedom of Information Act and the Federal Information Security Management Act FISMA among others. For public- and private-sector organizations protection of privacy information is a primary concern as well. Internal. Internal compliance is a means of risk mitigation for an organization examples of risks to be mitigated include corporate liability criminal or civil financial loss privacy breaches disclosure of intellectual assets discrimination harassment or breach of client attorney privilege. By all estimates the total cost of compliance is steep a 25 billion price tag in 2005 for the securities industry according to the Securities Industry Association SIA but the penalties for noncompliance can be much steeper including stock exchange de-listing multimillion-dollar fines and even prison terms. By some estimates up to 90 percent of the compliance costs are staff-related. The functionality introduced in Exchange Server 2007 reduces the complexity and lowers the effort required for compliance to meet the needs of many organizations of all sizes. As defined by Microsoft the primary capabilities required by an email compliance solution are as follows Message retention. Also defined as the email life cycle ELC this includes not only functionality to automatically retain email for specified time periods based on specified criteria but the ability to search for and retrieve retained email when required. This capability is particularly important for legal discovery and public-sector access to information requests as the penalties for noncompliance can be extremely steep. It does no good if the records have been retained but can t be located when required. Controlled access. Not only must
