Office 365 Data Protection: Part 2 – Litigation Hold

Part 2: Litigation Hold

In part 1, we discussed how you need to rely on more than the default retention times in Exchange Online to fully protect your data from accidental deletion. In part 2, we’ll discuss if Litigation Hold is a good-enough data protection solution for Office 365.

Does Microsoft protect against human error?

We know that users will accidentally, or maliciously, delete data from their Mailboxes. In the TechNet article we mentioned in part 1, Microsoft clearly states  that “point in time restoration of mailbox items is out of the scope of the Exchange service.”

Microsoft suggests that organizations implement their built-in preservation or time-based In-Place Holds. Litigation Hold and In-Place Holds (both introduced in Exchange 2010) were designed to preserve all mailbox data for a user. Litigation Hold preserves all email, and In-Place Holds preserve data based on specific parameters set by an admin. So yes, you can use these to preserve all of your organization’s email, but will you be able to rapidly restore it? There are basic data protection principles you should keep in mind when making this decision:

  • Litigation Hold (also known as preservation orders or hold orders) is a business process.

IT should not make the decision to put all users on litigation hold without the input of the organization’s legal team. If every email for every user is on hold, you could be introducing a liability to your organization because all of that content will discoverable.

Putting every user on litigation hold may make it harder for your legal team to search for mail items needed to answer a true legal request for information.

  • Use the correct tool for the job.

Backup software has a different purpose than archive software. Backup software makes a copy of production data and keeps it available so that the copy can be rapidly returned to production if it is needed. Archive software provides long-term data retention for data that is no longer actively used.

Microsoft’s Litigation Hold package is archiving software, and may be what your organization needs to meet legal compliance. However, if you need to have the ability to rapidly restore data that is lost due to accidental deletion choose the right tool for the job – third-party backup and recovery software.

  • Consider the administrative consequences.
    • How will you restore data? Litigation hold was created to find and export mail to answer another legal team’s request for information, not to restore accidentally lost data. The data may be preserved, but how are you going to restore it directly back into a user’s Office 365 account?It’s not easy to restore data from litigation hold. Check out the video where we recover email using Microsoft’s instructions. In the video, we only restore a few emails and it took us over 15 minutes. How long would it take if you had to restore an entire user’s account?
    • Restoring mail from litigation hold doesn’t preserve folder structure. Can you deal with the user pushback when you restore all of their mail — into their inbox without any organization?
    • Will the processes you follow to get the mail back to a user stand up under an auditor’s scrutiny?
    • How many requests do you currently get to restore mail that your users have misplaced while you are hosting Exchange on-premises. Will this labor-intensive process serve your IT processes?
    • Most importantly, what is your current RTO for restoring critical emails? Are you sure this restore process will allow you to meet your current SLA?
  • Never underestimate the insider threat.The wrong person with the right credentials can wreak havoc in your Office 365 tenant. Legal hold can be turned-off, retention periods can be set to zero days, and your email can be erased at compute speed. This is the biggest threat to your data.

Don’t suffer from using the wrong tool for the job when you need to rapidly restore Mail items back into production. Check out how quickly you can restore data with Spanning Backup for Office 365  via this video, or just download a free trial and test it on the mail in your tenant today.