Security Requirements for Selecting an Email Archiving Platform: A Buyer’s Guide to Criteria and Testing

An email archive is a second, complete copy of everything the organisation has said in writing, kept for years, searchable in seconds and connected to the mail system by a privileged service identity. It is bought for compliance and eDiscovery, so selections focus on retention rules, search speed and storage price, while the archive's own attack surface (its connector credentials, its search administrators, its export function and its immutability claims) gets far less scrutiny. This vendor-neutral buyer's guide sets out the security requirements to write into the RFP, how to score them, what to ask vendors and how to test the answers. It is for security architects, messaging owners, records managers, compliance officers and procurement leads choosing a cloud or self-hosted archive. For how journaling and archiving work and how to run them, see Email Archiving and Journaling.

Key takeaways

• Start from the record-keeping rule, not the feature list. If a regulation such as SEC Rule 17a-4 applies, the archive must meet its electronic recordkeeping requirements, either a complete time-stamped audit trail or non-rewriteable, non-erasable storage, and that choice drives the rest of the design.
• Immutability must hold against administrators. Ask what the vendor's own staff and your global administrators can delete or shorten, and test it; retention that a compromised admin can switch off is not a control.
• The connector is a high-value identity. Archives read every mailbox through journaling, API access or a service application; that credential deserves the same protection as a domain admin.
• Search and export are the real exfiltration path. Require role separation for searchers, case-scoped access, export approval and an audit trail of every search and download.
• Keep less, defensibly. Storage limitation under GDPR Article 5(1)(e) means the archive must also delete on schedule, with legal hold as the exception, not keep everything forever.

Define requirements

Agree the following with legal, compliance, records management and the messaging team before talking to vendors:

• Record-keeping obligations: list the rules that apply. US broker-dealers fall under SEC Rule 17a-4, which requires communications relating to the business to be kept for not less than three years, the first two in an easily accessible place; FINRA Rule 4511 requires a six-year minimum where no other period is specified and preservation in a format that complies with Rule 17a-4. Other sectors have their own periods. The Enterprise Messaging Retention and Off-Channel Communications Guide covers the messaging side.
• Privacy obligations: UK and EU GDPR require personal data to be kept no longer than necessary. The ICO expects a documented retention schedule, review at the end of each period and erasure or anonymisation, and notes that deletion should extend to backups. See the GDPR Compliance Guide for Security Teams.
• Content scope: email only, or also chat, collaboration messages, SMS and voice. Each source needs its own capture connector and credential.
• Capture method: journaling (a copy of each message sent to the archive at transport time), API-based capture from mailboxes, or both. Journaling captures messages before users can delete them; API capture depends on a privileged application reading mailboxes.
• Users of the archive: end users searching their own mail, compliance reviewers, legal teams running eDiscovery and outside counsel. Each needs a different role.
• Hosting and residency: region, customer-managed keys, sovereignty requirements and whether any on-premises gateway or agent is acceptable.
• Exit and migration: archives outlive vendors. Define how records, metadata, audit trails and holds will move on exit, and how chain of custody will be shown.

A small business without a sector rule can treat the archive mainly as an eDiscovery and retention tool and focus on access control, retention and deletion, and export auditing. Regulated firms should add audit trail or WORM evidence, third-party undertakings where the rule asks for them, customer-managed keys, independent assurance scoped to the archive service and contractual rights to download records and audit trails.

Capability areas

Record integrity and immutability

• Regulatory storage mode: for SEC-regulated firms, either a complete time-stamped audit trail capturing all modifications and deletions with date, time and the identity of the person making each change, or storage exclusively in a non-rewriteable, non-erasable format (Rule 17a-4(f)(2)(i)).
• Verification: automatic verification of the completeness and accuracy of storage and retention processes (17a-4(f)(2)(ii)), shown as reconciliation reports between the mail system and the archive.
• Retention lock: retention policies that cannot be shortened or removed by any administrator once locked, including your global administrators and the vendor's own staff.
• Tamper evidence: message hashes or equivalent integrity checks at ingestion, so a record produced in court or to a regulator can be shown to be unaltered.
• Download and redundancy: the ability to download a record and its audit trail in a human-readable and reasonably usable format, and a backup or redundant set (17a-4(f)(2)(iv) and (v)).

Capture connectors and service identities

• Journaling delivered over authenticated, TLS-encrypted transport to a dedicated address, with alerts when journal delivery fails, since undeliverable journal reports can be lost.
• API capture through a dedicated application identity per tenant, with the narrowest permissions the vendor can document, certificate-based credentials rather than shared secrets and a supported rotation procedure without loss of capture.
• Per-customer credentials. A connector certificate or secret shared across the vendor's customer base turns one theft into many tenant compromises.
• Gap detection: alerts when capture stops for a mailbox or source, and a reconciliation report proving nothing was missed.

Two incidents show why. In the Mimecast certificate compromise, attackers used a stolen certificate that authenticated several of the vendor's products, including its Sync and Recover service, to customers' Microsoft 365 tenants. In the ConnectWise cloud backup breach, a stolen application secret for a Microsoft 365 backup service opened more than 160 tenants. An archive connector has the same shape and the same reach.

Access control, search and export

• SSO with SAML or OpenID Connect and enforced MFA for every archive user, with local accounts limited to documented break-glass use.
• Role separation between archive administration, retention policy management, compliance review, eDiscovery case management and end-user self-service.
• Case-scoped access so a reviewer sees only the custodians and date ranges in their matter, and dual approval or second-person review for searches across all mailboxes.
• Export controls: approval workflow, export size limits, watermarking or encrypted export packages and an audit event for every export and download.
• Restrictions on privileged mailboxes, such as those of the board, HR and legal, with access only through named roles.

Retention, legal hold and deletion

• Retention policies by mailbox group, message class or content, with holds that always take precedence over deletion.
• Defensible disposal: scheduled deletion at the end of the period, a deletion report and confirmation that copies in backups and replicas expire on a stated schedule.
• Support for subject access and erasure requests where no legal hold or record-keeping duty applies. See the Data Retention and Secure Deletion Guide and the eDiscovery and Legal Hold Guide.

Encryption and data protection

• Encryption in transit for capture, search and export, and at rest for message stores, indexes and attachments.
• Customer-managed keys where needed, with clear documentation of what happens to search and retention if the key is revoked.
• Malware handling for archived attachments, so a restored or exported message cannot reintroduce a payload unchecked.

Audit, monitoring and vendor assurance

• Audit records for sign-ins, searches (with query terms), views, exports, downloads, policy changes, hold changes and deletions, exportable to your SIEM. Rule 17a-4(f)(3)(iii) also expects firms using WORM storage to keep an audit system for record input and changes for as long as the records themselves.
• Vendor staff access to customer archives only under customer approval, with that access logged and visible to you.
• Independent assurance scoped to the archive service and region, a vulnerability disclosure policy, and, for SEC-regulated firms, the vendor's readiness to act as or support the designated third party required for the undertakings in 17a-4(f)(3)(v).

Evaluation criteria

Weights are illustrative, set by NHI Mgmt Group as a starting point. Regulated firms should raise record integrity; organisations without a sector rule should raise search, export and deletion controls.

The table below maps archive threats to the requirement that addresses each. ATT&CK IDs are from ATT&CK v20.

Where identity fits

The archive is a non-human identity problem as much as a storage one. Its connector identity has read access to every mailbox, often granted with broad application permissions that bypass user MFA, and it is rarely in anyone's credential inventory. Require the vendor to document every identity it creates in your tenant, its permissions and how to rotate or revoke it, and add each to your inventory with an owner. See the NHI Discovery Guide. Human access matters too: archive searchers can read any custodian's mail, so treat compliance and eDiscovery roles as privileged access with periodic review.

Questions to ask vendors

• Which record-keeping rules do you support, in which storage mode (audit trail or non-rewriteable, non-erasable), and what independent assessment backs that claim?
• Once a retention policy is locked, can any administrator, including our global administrator or your support staff, delete records or shorten retention? Show us.
• What identities do you create in our mail tenant, with which permissions, and is any credential shared across customers?
• How do we rotate the connector credential without losing capture, and how do you alert us if capture stops?
• How do you prove capture completeness, and how often is reconciliation run?
• Can search access be scoped by case, custodian and date range, and can wide searches require a second approver?
• Is every search query, view, export and download logged with the user identity, and can we stream those logs to our SIEM?
• When does deleted content leave backups and replicas, and can you issue a deletion report?
• Under what conditions can your staff access our archive, and is that access logged and visible to us?
• On exit, how will you deliver records, metadata, holds and audit trails, in what format and within what period?

Red flags

• "WORM" or "immutable" claims with no explanation of what administrators and vendor staff can still delete.
• A single connector certificate or secret used across all customers.
• Searches and exports that are not logged, or logs that omit the query and the volume exported.
• No gap detection: capture failures are discovered only when a record cannot be found.
• Deletion that never reaches backups, or no answer on backup expiry.
• Exit terms that provide messages without metadata, holds or audit trails, or charge per gigabyte to leave.

Proof of concept

1. Connect the archive with a dedicated connector identity, record every permission granted in the tenant and compare with the vendor's documentation.
2. Send test messages, delete some from mailboxes immediately and confirm they are still captured; stop journal delivery and confirm an alert fires.
3. Lock a retention policy, then try to shorten it, delete a record and disable the policy as a global administrator; ask the vendor to attempt the same through support.
4. Apply a legal hold to a custodian whose retention has expired and confirm the hold wins.
5. Run a case-scoped search as a reviewer, try to search outside the case, then perform a large export and confirm approval, audit events and SIEM delivery.
6. Rotate the connector credential and confirm capture continues without gaps.
7. Export a sample of records with audit trails in the exit format and verify integrity values.

Score each step against the criteria table. If immutability or connector identity tests fail, do not proceed; keep the existing archive and its holds running until a compliant replacement is proven, since migrating holds is the hardest step to undo.

After selection: measures and common failure patterns

Track after go-live: capture gaps detected and closed per month; age of the connector credential against your rotation standard; number of archive users with search-all rights; exports by volume and approver; records past retention not yet disposed of; and time to fulfil a legal hold request.

• Connector with tenant-wide write: the capture application is granted read and write on all mail because least privilege was never tested.
• Compliance admins without MFA: archive roles are assigned outside the IdP and miss conditional access.
• Retention never locked: policies are configured but not locked, so one compromised admin can shorten them.
• Keeping everything: no disposal is ever run, which turns the archive into the largest store of personal data in the organisation.
• Migration without chain of custody: records move between archives without hashes or audit trails and later cannot be shown to be complete.

Framework mapping

Standards and references

• SEC: 17 CFR 240.17a-4, Records to be preserved by certain exchange members, brokers and dealers
• FINRA: Rule 4511, General Requirements
• ICO: Principle (e), Storage limitation
• CISA: Secure by Demand Guide
• NCSC: The Cloud Security Principles
• NIST: SP 800-53 Rev. 5

How NHI Mgmt Group can help

We provide independent requirements, RFP and evaluation support. Browse vendors in our products directory or contact us.

Related NHI Mgmt Group resources: Email Archiving and Journaling · eDiscovery and Legal Hold Guide · Email Security Buyer's Guide · Log Retention Requirements Map. This guide summarises record-keeping and data protection requirements and is not legal advice.