First, you must understand the difference between journaling and archiving:

• Journaling is the ability to record all communications, including e-mail communications, in an organization for use in the organization's e-mail retention or archival strategy. To meet an increasing number of regulatory and compliance requirements, many organizations must maintain records of communications that occur when employees perform daily business tasks.
  
  
• Archiving refers to backing up the data, removing it from its native environment, and storing it elsewhere, therefore reducing the strain of data storage. You may use Exchange journaling as a tool in your e-mail retention or archival strategy.
  
  

Although journaling may not be required by a specific regulation, compliance may be achieved through journaling under certain regulations. For example, corporate officers in some financial sectors may be held liable for the claims made by their employees to their customers. To verify that the claims are accurate, a corporate officer may set up a system where managers review some part of employee-to-client communications regularly. Every quarter, the managers verify compliance and approve their employees' conduct. After all managers report approval to the corporate officer, the corporate officer reports compliance, on behalf of the company, to the regulating body. In this example, e-mail messages might be one type of the employee-to-client communications that managers must review; therefore, journaling can be used to collect all e-mail messages sent by client-facing employees. Other client communication mechanisms may include faxes and telephone conversations, which may also be subject to regulation. The ability to journal all classes of data in an enterprise is a valuable functionality of the IT architecture.

The following list shows some of the more well-known U.S. and international regulations where journaling may help form part of your compliance strategies:

• Sarbanes-Oxley Act of 2002 (SOX)
  
  
• Security Exchange Commission Rule 17a-4 (SEC Rule 17 A-4)
  
  
• National Association of Securities Dealers 3010 & 3110 (NASD 3010 & 3110)
  
  
• Gramm-Leach-Bliley Act (Financial Modernization Act)
  
  
• Financial Institution Privacy Protection Act of 2001
  
  
• Financial Institution Privacy Protection Act of 2003
  
  
• Health Insurance Portability and Accountability Act of 1996 (HIPAA)
  
  
• Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001 (Patriot Act)
  
  
• European Union Data Protection Directive (EUDPD)
  
  
• Japan’s Personal Information Protection Act
  
  

Return to top

You can target the journal rule to Internal, External, or Global recipients. The following list describes these scopes:

• Internal   Journal rules with the scope set to Internal target messages sent and received by recipients inside your Exchange organization.
  
  
• External   Journal rules with the scope set to External target messages sent to recipients or received from senders outside your Exchange organization.
  
  
• Global   Journal rules with the scope set to Global target all messages that pass through Hub Transport servers. These include messages that may have already been processed by journal rules in the Internal and External scopes.
  
  

You can implement targeted journaling rules by specifying the SMTP address of the recipient you want to journal. The recipient can be an Exchange mailbox, distribution group, or a contact. These recipients may be subject to regulatory requirements, or they may be involved in legal proceedings where e-mail messages or other communications are collected as evidence. By targeting specific recipients or groups of recipients, you can easily configure a journaling environment that matches your organization's processes and regulatory and legal requirements, and minimize storage and other costs associated with retention of large amounts of data.

All messages sent to or from the journaling recipients you specify in a journaling rule are journaled. If you specify a distribution group as the journaling recipients, all messages sent to and from members of the distribution group are journaled. If you don't specify a journaling recipient, all messages sent to or from recipients that match the journal rule scope are journaled.

Unified Messaging-Enabled Journal Recipients

Many organizations that implement journaling may also use Unified Messaging (UM) to consolidate their e-mail, voice mail, and fax infrastructure. However, you may not want the journaling process to generate journal reports for messages generated by Unified Messaging. In these cases, you can decide whether to journal voice mail messages and missed call notification messages handled by an Exchange 2010 Unified Messaging server or to skip such messages. If your organization doesn't require journaling of such messages, you can reduce the amount of hard disk space required to store journal reports by skipping such messages. When you enable or disable the journaling of voice mail messages and missed call notification messages, your change is applied to all Hub Transport servers in your organization.

Note:
Messages that contain faxes generated by a Unified Messaging server are always journaled, even if you configure a journal rule that specifies not to journal Unified Messaging voice mail and missed call notification messages.

For more information about how to enable or disable voice mail and missed call notification messages, see Managing Journaling.

Return to top

The journaling mailbox is used for collecting journal reports. How the journaling mailbox is configured depends on your organization's policies, regulatory requirements, and legal requirements. You can specify one journaling mailbox to collect messages for all the journal rules configured in the organization, or you can use different journaling mailboxes for different journal rules or sets of journal rules.

Important:

Journaling mailboxes contain very sensitive information. You must secure journaling mailboxes because they collect messages that are sent to and from recipients in your organization. These messages may be part of legal proceedings or may be subject to regulatory requirements. Various laws require that messages remain tamper-free before they're submitted to an investigatory authority. We recommend that you create policies that govern who can access the journaling mailboxes in your organization, limiting access to only those individuals who have a direct need to access them. Speak with your legal representatives to make sure that your journaling solution complies with all the laws and regulations that apply to your organization.

For more information about how to configure the journaling mailbox, see Managing Journaling.

For more information about how to protect journaling mailboxes, see Protecting Journal Reports.

Return to top

When implementing journaling in an Exchange 2010 environment, you must consider journaling reports and IRM-protected messages. IRM-protected messages will affect the search and discovery capabilities of third-party archiving systems that don't have RMS support built-in. In Exchange 2010, you can configure Journal Report Decryption to save a clear-text copy of the message in a journal report. For more information, see Understanding Journal Report Decryption.

Return to top