Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My company is a private, family owned business. The company is head quartered in USA and also runs businesses in several countries including Mexico, UK, Canada, Carribean islands and few other countries in S.America.

Me and my boss had a discussion over lunch regarding IT compliance and we wondered what kind of mail archiving solution we need to pursue and what are the other IT related compliance we need to pursue.

Our processes include online and phone based sales, phone based customer support, w-9 (SSN and EIN) verification, etc.

share|improve this question

closed as too localized by Mark Henderson Jan 12 '12 at 5:51

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
No only is this too localised, it's not even a sysadmin question. Once you know WHAT you need to do then you can ask questions about HOW to implement it. –  John Gardeniers Apr 16 '10 at 5:38

1 Answer 1

up vote 10 down vote accepted

Ask a lawyer. Or one for each country. They know what you have to do (not how to do it, of course). After that, you can ask the "how?" here.

share|improve this answer
2  
This. Definitely. Compliance is one of those issues which, while it's absolutely relevant to IT, can't be answered solely by IT. You must consult your businesses legal authority. Which for a small business, is most likely a lawyer they retain. –  Chris Thorpe Apr 16 '10 at 1:18
    
Don't hire an IT Consultant. Talk to a lawyer, figure out what you really need. –  Joseph Kern Apr 16 '10 at 1:41
    
Yes, seek an attorney's advice, but realize that not every attorney may be up to speed on E-Discovery and if they are, are able to translate that into what IT needs to do to be in compliance. Do you use payment card data? Then you need to be following the PCI Data Standard (very stringent). You may need to be concerned about HIPPA if you retain any employee medical records. –  jl. Apr 16 '10 at 13:24

Not the answer you're looking for? Browse other questions tagged or ask your own question.