Forensic mode infrastructure

In forensic mode, all notifications can be categorized using the task notification was initiated by. For example, all new request notifications for vendors can be captured and stored separately from notifications sent to the staff members or requester.

mailboxes and e-mail content filters

Before deploying forensic mode the decision needs to be made if each category of notifications will have its own mailbox or all communication will be stored in a single mailbox with automated content filters. It is possible to deploy a hybrid solution using both features at the same time.

Making selection how the messages will be stored should be done before deployment of the forensic mode. Factors such as storage limits, retention policies and access right should be considered.

The diagram below provides an example for hybrid implementation of the forensic mode. This is the recommended form of the infrastructure for large organizations with no restrictions on storage. The structure allows capturing all messages and categorize them by the type of recipient. The filtered messages are then stored in separate folder.

IT department can assign access rights to the mailboxes that store the messages. More complex settings can be implemented with read only rights for a group of users within the organization.

Retention policy and back up

For majority of organization 7 years retention should be sufficient to meet most of the compliance requirements. With electronic storage costs constantly decreasing, retention limits can be removed completely.

Regular back up of the mailboxes should be part of the IT policy.  Use of full and not incremental back up is recommended.

If storage restrictions exist, an automated policy of removal for messages older than retention period should be implemented.  For compliance purpose, archived copies of the messages should be preserved.

HIPAA compliance

Standard policies should be applicable for archived messages and storage.  High-grade encryption and password protection are recommended.