Archiving with Vault

Organizations nowadays are well aware of the need for keeping detailed reports. This is not only useful for the organization—it is also a compliance mandate. However, being able to capture and store all information that conforms to compliance requirements is challenging for organizations lacking the necessary tools and experience.

This chapter will discuss Google Vault, which is a tool that was designed to assist organizations with legal requirements pertaining to information retention. Vault is particularly useful while facing legal inquiries, performing investigations, and responding to a request for records.

Google Vault is included with no extra cost in G Suite for Business, but can also be bought separately with a monthly fee. In this chapter, you will learn how to use the power of Vault and eDiscovery to find virtually anything that was ever done...

Setting up Retention

In this section, we will have a look at retention rules and how they can be used to sort information that needs to be preserved. Defining retention rules is the first step toward setting up Vault. Retention rules are a set of instructions that direct Vault on what files to keep, and for how long.

There are two types of retention rules, as follows:

Custom retention rules: These rules allows you to specify the retention period for data that meets specific criteria.
Default retention rules: With these, you can define rules that apply to the entire organization. These are only applied when there is no applicable custom rule or legal hold.

To set up retention rules, click Retention on Vault's left menu, as shown in the following screenshot:

It is important to be very careful when defining or changing retention rules since it may cause permanent loss of...

Implementing matters

Google Vault uses matters to contain all data related to one investigation by grouping all the information associated with it.

When you are using Vault to search for information, you must do so from within a matter. It will allow you to store and share your findings related to a particular investigation.

You can define the scope of your searches as wide as a whole organization, or narrow it down as much as you need to isolate the information that's needed for the investigation.

My matters

When you find something while searching company data, you can save the query as a matter so that you can use it again later or share it with another authorized user. In other words, since the information is persistently...

Understanding Reports

At this point, you have learned how to use Vault's Retention and Matters, so it's time for you to learn about what can be found at the bottom of the menu, that is Reports:

The Reports menu contains the Audit tool and also reports for the current Domain Holds, Users Holds, and Group Holds.

To open a report, click on the name, and you will see a list of the active elements for that category. To download a copy of the information within a report, click on the Download CSV button on the top right corner.

Since Vault has access to sensitive information, it logs every action on it as a security measure. Audit is a special tool that allows you to filter and download all the actions that are performed by administrators inside Vault:

To perform an audit, observe the following steps:

Select date range that you wish to audit. Leaving the Start date empty...

Summary

Congratulations on finishing another chapter! You have just learned how to prepare the domain to comply with legal requirements while facing or performing an investigation.

You are now capable of setting the default retention rules on this domain to define the minimum data retention period for the different G Suite components.

In this chapter, you also learned how to make Vault keep an eye out for messages or documents that match specific criteria, and apply a custom retention rule so that these records are kept for a longer period of time than others, or kept indefinitely.

We learned how to implement matters to group all the information that might be relevant to an investigation and how to use them to apply data holds to guarantee that those records will be kept for as long as necessary.

You now know how to search through the information that's held within a matter...