Compliance and Best Practices for Deploying Skype for Business

WHITE PAPER

Compliance and Best Practices

for Deploying Skype for Business

An Osterman Research White Paper SPON Published September 2015

sponsored by

sponsored by SPON Osterman Research, Inc. P.O. Box 1058 • Black Diamond, Washington • 98010-1058 • USA Tel: +1 253 630 5839 • Fax: +1 253 458 0934 • [email protected] www.ostermanresearch.com • twitter.com/mosterman

Compliance and Best Practices for Deploying Skype for

Business EXECUTIVE SUMMARY Skype for Business represents the consolidation of Microsoft’s primary telephony and unified communications platforms:

• Skype was originally released in August 2003 by a group of Scandinavian and Baltic developers who sold their platform to eBay 25 months later for $2.6 billion. Four years after that, a group of investors acquired 65% of Skype for $1.9 billion, giving the company a valuation of $2.75 billion. This was followed 20 months later by Microsoft’s acquisition of Skype for $8.5 billion. Today, there are 50 billion minutes of traffic generated on Skype during a typical monthi, accounting for approximately one-third of all long-distance traffic worldwide.

• Microsoft released Office Communicator 2007 in October 2007, which was later rebranded and relaunched as Microsoft Lync 2010 in December 2011. Lync is Microsoft’s corporate unified communications platform and has more than 100 million users and 79% of US businesses using or planning to deploy itii. Lync and Lync Server 2013 were released in 2012. In late 2014, Microsoft announced that it would rebrand Lync, as Skype for Businessiii. Skype for Business was officially launched in April 2015.

Skype for Business includes a number of capabilities, including telephony, instant messaging, presence capabilities, video calling, group conferencing, whiteboard sharing, remote desktop control, persistent chat, and other unified communications capabilities.

KEY TAKEAWAYS • Telephony – a key component of Skype for Business’ capabilities – is second only to email in terms of the amount of time that users spend on a typical day in the context of their communications and collaboration activities.

• A growing proportion of organizations are migrating to unified communications because of its inherent advantages for fostering collaboration, enabling telework, and improving corporate agility.

• Skype, and increasingly Skype for Business, are leading offerings in the unified communications space. Microsoft’s share of the unified communications market is growingiv, and we anticipate that the company will become the leading company in the space in the near future.

• Deploying Skype for Business requires careful planning to overcome the technical and business obstacles inherent in the paradigm shift that it, and the overall migration to unified communications, represents.

• Skype for Business requires proper management to ensure that organizations are properly monitoring content sent through the platform, and that business records generated and stored within it are properly archived.

ABOUT THIS WHITE PAPER This white paper was sponsored by Actiance. Information about the company and its relevant Skype for Business-related offerings are located at the end of the paper.

TELEPHONY IS STILL ESSENTIAL THE SECOND MOST IMPORTANT TOOL BEHIND EMAIL Email is the primary communications and file-sharing platform in use today, but telephony continues to be an essential mode of communication, coming in second to email, but consuming 62 minutes of the typical user’s workday, as shown in Figure 1.

Compliance and Best Practices for Deploying Skype for

Business Figure 1 Minutes Spent per User per Day on Various Communication Tools

Source: Osterman Research

Underscoring the essential role played by telephony is the fact that there are more telephones (landlines, smartphones and feature phones) than people on earthv; and almost every household in the United States has telephony capabilities, whether provided by a landline and/or mobile phone. Moreover, many email users find that the telephone is often the best way to transmit sensitive information for which users do not want a record, since voice calls are rarely archived or backed up (that’s changing), unlike emails, instant messages, social media posts and other forms of electronic communication. Plus, one study found that 38% of the efficacy of communications – i.e., the ability to convey information in the way it was intended – is contributed by voice tonevi, making telephone communications an essential for business and non-business communications.

In spite of the growing use of the Web, email, mobile device apps and other modes of communication, telephony remains essential across a wide range of applications, including customer service and sales. As just one example, one study found that 90% of US consumers prefer to resolve their service issues by telephone, compared to face-to-face interactions (75%) and Web/email (67%)vii.

Consequently, telephony will remain an important and business-essential communications mode, and the ability to manage telephony well will be critical to business success.

CONVENTIONAL TELEPHONY HAS MAJOR LIMITATIONS A conventional communication and collaboration system in the typical workplace provides each employee or other worker with most or all of the following components:

• An email client (typically Microsoft Outlook) that includes calendaring and task management along with sophisticated email capabilities.

• A desktop telephone.

• An instant messaging client.

Compliance and Best Practices for Deploying Skype for

Business • A social media account.

• A mobile phone that, among other things, offers text messaging/SMS services.

• Access to a customer relationship management (CRM) system to manage and communicate with customers and prospects.

• Availability of a departmental fax machine.

Despite the utility of these tools, the conventional communications and collaboration paradigm has several inherent limitations, which include:

• Email messages and attachments are accessed in an email client on a computer or mobile platform.

• Voice calls are placed on, and voicemail is accessed through, a telephone.

• Social media is accessed through another client.

• Instant messaging conversations are conducted in a dedicated client.

• When faxes are sent or received, users must walk to a fax machine and process individual pieces of paper or images/PDFs that are delivered to their email inbox.

Consequently there is minimal integration of data between the different communication modes, the interoperability between them is poor, and there is a lack of organizational flexibility and agility when accessing the various communications tools and data stores.

THE BENEFITS OF TRULY UNIFIED COMMUNICATIONS Separately deployed and separately managed communications tools and interfaces are somewhat workable if the user is in a traditional office setting. However, there are several limitations in the current, desktop-centric paradigm. For example:

• More users work outside of a typical office environment and so are not as productive when doing so with conventional communications capabilities. For example, when users are working remotely, their desktop telephone and fax capabilities are not directly accessible. Only email will work more or less like the in-office experience because browser-based email operates much like the Outlook client that most users have available to them in the office.

• If employees and contractors cannot work remotely, this results in higher facilities costs because organizations must provide work space for a larger proportion of the workforce.

• IT costs are normally higher in a disjointed environment because IT staff members must manage multiple systems, each with its own management interface, upgrade cycles, training requirements, etc.

• Finally, corporate agility is minimized because information workers are more limited in their remote work capabilities, and so there are fewer options for employing remote workers or implementing telework programs.

This approach to workplace communications allows users to be productive, but only to a point. Alternatively, consider the benefits of a communications system in which all of the capabilities are unified into a single solution:

• Information workers are able to send or receive email, use the telephone, access voicemail, initiate instant messaging conversations, and send or receive faxes from a single interface. Moreover, data can be shared digitally between all of these communication modes.

Compliance and Best Practices for Deploying Skype for

Business • These communications modes are accessible on any desktop, laptop or mobile platform available to the user, regardless of their location using a thick client or virtually any Web browser.

The “unified communications” approach is what its name implies – an integrated set of communication and collaboration tools that users access via a single interface and that are managed as a single platform. Unified communications includes various tools, including email, voice/telephony, calendaring and scheduling, and real-time communications capabilities that are available to a user through a thick client and/or a Web browser. Other functions that might be included in a unified communications system are text messaging/SMS capabilities, Web conferencing and mobility services. Various unified communications systems also integrate security capabilities like intrusion prevention and email filtering services.

UNIFIED COMMUNICATIONS IS BRINGING TELEPHONY BACK INTO THE LIMELIGHT The typical user spends roughly three times more minutes per day using capabilities in email than he or she does on the telephone. Part of the reason for this is the inherent benefits of email for store-and-forward communications, the ability to manage records more easily in email, and the ability to more effectively share content in email than via the telephone. However, two additional likely reasons for the growing disparity between the use of email and telephony are:

• The increasing mobility of the workforce means that users are often away from a desktop telephone. While the vast majority have access to mobile phones, these are often personally managed devices and not linked to a corporate telephone directory, making users less accessible or discoverable than they would be if they were in the office.

• Traditional telephony simply does not adequately meet the communication requirements for a workforce that increasingly relies on non-telephony modes of communication like email, text messaging, social media and other, newer forms of communication.

To a great extent, one of the key benefits of unified communications is its ability to “modernize” telephony: to make it accessible from a common interface with other communication tools, and to enable its access from an IT-managed capability that integrates its capabilities with other communication and collaboration tools.

SKYPE IS BECOMING A MAINSTREAM BUSINESS TOOL CONSUMER SKYPE IS WIDELY USED Skype, which originally was a consumer-only VoIP tool, has been in use for many years in the workplace as an alternative to company-provisioned telephony. Consumer Skype is free, has good call quality, free long-distance calling, and robust flexibility in enabling telephony for remote users whose organizations have not yet deployed unified communications. In some organizations, Skype has become a de facto, employee-deployed unified communications platform and an essential driver of the general trend toward shadow IT.

THE LEGITIMACY OF SKYPE IS INCREASING OVER TIME While Skype was typically installed on users’ desktops, laptops and mobile devices without the blessing of IT and so was not officially supported, IT decision makers have been gradually warming to the idea of Skype for quite some time. For example, Osterman Research has been tracking the perceived “legitimacy” of various applications for many years, asking IT staff in mid-sized and large organizations if they might consider these applications to be legitimate for use in their own organizations. In 2010, only 42% of those surveyed by Osterman Research

Compliance and Best Practices for Deploying Skype for

Business considered Skype to be a legitimate application for use in their organizations. By 2012, 52% of decision makers believed this was true, and 55% believed Skype to be legitimate for use by 2014, as shown in Figure 2.

Figure 2 Perceived Legitimacy of Various Tools for Business Purposes

Source: Osterman Research, Inc.

SKYPE FOR BUSINESS WILL BECOME MORE IMPORTANT Real-time communications capabilities have been offered by Microsoft for a number of years for both the consumer and enterprise markets. Previous Microsoft offerings have included Live Communications Server (2003), Office Communications Server (2007), and Lync Server (2010). In late 2014, Microsoft changed the name of Lync to Skype for Business and, like Lync, announced that it would be offered as both an on- premises solution and as a cloud component within Office 365.

Other than the name change, Microsoft has made significant improvements in Skype for Business compared to Lync, such as:

• The Skype for Business interface has a new look and feel, although Microsoft has kept Lync’s Quick Action buttons that allow users to establish an instant messaging conversation or call someone on their contact list.

• For those organizations that have deployed Skype for Business Server 2015, users can employ their existing desktop phones as part of an on-premises PBX system to make calls.

• Users can now preview file transfers before downloading.

• Users now have the ability to match the Skype interface to participation in a call, allowing them to switch back and forth between a full Skype for Business window and a smaller version of the window when they are merely listening in on a call.

• Integration with the Skype directory is now available.

Compliance and Best Practices for Deploying Skype for

Business A survey by No Jitterviii discovered that the majority of Skype for Business users use the platform for a variety of applications, including instant messaging, audio conferencing, presence notification and Web conferencing. While most do not yet use it as an enterprise voice/PBX replacement, 25%+ are using Skype for Business as their primary voice solution. Among organizations that have adopted Skype for Business as a replacement for their PBX, most have found it to be better than the voice solution it replaced.

DEPLOYING SKYPE FOR BUSINESS OVERCOMING THE OBSTACLES A key inhibitor to the adoption of unified communications is that many fear a major shift in the way their users communicate and the way that communications and collaboration are managed. For example:

• Unified communications is a paradigm shift from the status quo of standalone and siloed communications solutions, and so necessitates a corporate rethink about how communications will be delivered and the solutions that will deliver it.

• Traditional organizations that have separate IT and telecom departments often have to deal with cultural and “turf” issues because unified communications represents the melding of different groups with different leadership and agendas that may not align completely.

• The majority of organizations lack the in-house expertise to evaluate, deploy and manage all of the key unified communications solutions. As a result, this can be an impediment for many decision makers simply because they do not know where to begin.

• Finally, unified communications may require major changes to the corporate network. This may include adding more bandwidth, migrating key services to the cloud, and thinking about service delivery in different ways.

TECHNICAL BEST PRACTICES When planning to deploy Skype for Business, there are three technical best practices to consider:

• The network on which Skype for Business will run must be validated in order to determine the bandwidth that will be required to support all necessary Skype for Business functions, including voice and video, and the network must be evaluated in order to determine its maximum and acceptable latency. In terms of bandwidth, Lync/Skype for Business requires a typical and maximum PC-to-PC bandwidth of 7.25 Mbps and 14.25 Mbps, respectively, to support 250 concurrent telephone calls. However, for PC-to-PSTN calls, these figures are 16.20 Mbps and 24.25 Mbpsix.

However, video traffic requires dramatically more bandwidth. For example, to support 250 concurrent video calls requires 55.00 Mbps to 302.50 Mbps (typical), but as much as 377.50 Mbps (peak). Not all networks are able to accommodate such significant bandwidth requirements, particularly during peak periods.

• Moreover, the appropriate architecture must be implemented to accommodate the anticipated maximum number of users during normal and peak periods. Skype for Business Server 2015, for example, includes the Unified Communication Web API (UCWA) service that makes Skype for Business features available via the HTTP protocol.

The decision of how to deploy Skype for Business – and the architecture that will be implemented – is predicated on how it will be used. For example, if an organization has legal obligations to retain data on-premises or it needs to use

Compliance and Best Practices for Deploying Skype for

Business the Enterprise voice component in Skype for Business, it will typically need to deploy Skype for Business using an on-premises architecture (Skype for Business Online does not currently support Enterprise voice). In other cases, an organization can deploy Skype for Business using a hybrid architecture a) if they are not required to retain data on-premises, b) only some users require Enterprise voice capabilities, or c) there are technical limitations in supporting all users via a cloud delivery model.

• Finally, it is essential to simulate network traffic in order to determine if the existing network – or an affordable and practical expansion of it – can accommodate all of the required capabilities that will be required in Skype for Business.

BUSINESS BEST PRACTICES Just about every company has made major investments in their IT and telecom systems – email servers, applications, PBXs, and other systems in support of the communications and collaboration capabilities on which their users rely. These key infrastructure investments, as well as investments in the applications that run on the current infrastructure, often have not been fully depreciated and so many decision makers are understandably reluctant to replace them prematurely.

So, should an organization even consider replacing its legacy communications and collaboration investments before they have been fully depreciated? In most cases, the answer is “yes” if a business case can be made that the benefits from the new technology will be greater than the remaining value in the legacy solutions. For unified communications, that business case is normally not difficult to make.

However, there are some essential elements to consider as organizations undertake the path to truly unified communications:

• The use of technology partners is an essential component of the migration simply because most organizations lack the internal expertise to address and resolve all of the issues that will arise during the migration and subsequent operation of the platform. This will typically require the use of technology partners that are skilled in the deployment and management of unified communications, particularly Skype for Business.

• Proper training is also an essential requirement to help users through the process of migrating to unified communications. While unified communications and Skype for Business provide important productivity benefits, getting to these benefits requires sufficient end-user training.

• One of the key benefits of unified communications and Skype for Business is its ability to support telework and remote work capabilities. While unified communications can provide important benefits for a “stationary” workforce, it provides the greatest benefits for highly distributed and mobile workforces.

• Finally, there is a need to manage content in unified communications solutions and Skype for Business. This management includes archiving of content in not only Skype for Business, but also Yammer and other social media platforms, not to mention traditional platforms like email and file share. Integration of the archiving capabilities for all modes of communications is an essential best practice in order to maximize the efficiency of litigation holds, eDiscovery, regulatory compliance activities and the like. Moreover, information flows must be monitored in accordance with corporate policies, regulatory obligations and legal requirements.

Compliance and Best Practices for Deploying Skype for

Business PROPER MANAGEMENT IS ESSENTIAL

MONITORING ALL COMMUNICATIONS IS CRITICAL Email, files, instant messages, social media posts – and Skype for Business content – contains various levels of business content, some of it sensitive and confidential. Consequently, all communications must be monitored for a variety of purposes, including maintaining regulatory compliance, protecting intellectual property from leakage or theft, enforcing corporate policies, and ensuring compliance with legal obligations. It is essential to have in place a robust monitoring capability to ensure that all information flowing through business communication channels is monitored for potential violations and managed appropriately.

ARCHIVING OF DIGITAL CONTENT IS ESSENTIAL The archiving and compliance capabilities in Office 365, of which Skype for Business is an increasingly essential component, address only content stored in the Office 365 environment and, even then, only parts of the content stored there. For example, Office 365 offers archiving capabilities for Exchange Online, but no similar capabilities for SharePoint or Yammer content or for Skype for Business. Content stored outside of Office 365 isn’t addressed at all. With many organizations running hybrid environments for communications and collaboration, as well as using non-Microsoft services and needing to deal with content in legacy systems, relying on the archiving and compliance capabilities in Office 365 will not satisfy all of an organization’s archiving requirements, including those in Skype for Business.

In short, organizations that deploy Skype for Business must archive the content within it for purposes of eDiscovery, regulatory compliance, litigation holds and early case assessments.

A GROWING TREND TO ARCHIVE VOICEMAIL AND OTHER CONTENT FROM REAL TIME COMMUNICATIONS SYSTEMS Frankly, for a variety of reasons few organizations today archive voicemail explicitly. Reasons for not doing so include the difficulty associated with archiving voicemail in conventional telephone systems, as well as the difficulty of processing this information during activities like early case assessments or eDiscovery. Moreover, some organizations are actively moving away from the entire notion of voicemail, such as JP Morgan’s retail employeesx.

However, Osterman Research believes that voicemail, as well as other content in Skype for Business, will increasingly need to be archived for two reasons:

• The Federal Rules of Civil Procedure (FRCP) require the preservation of Electronically Stored Information (ESI). Voicemail, including its metadata, is no exception, largely because voicemails are typically stored in digital format and stored for some period of time. While many decision makers forget voicemail in the context of other ESI for purposes of litigation holds or eDiscovery, they should not. As noted by Matthew S. Adams in a March 2015 article, “Too often, voicemail is forgotten when it comes to instituting a litigation hold. This can be disastrous, resulting in potential claims of spoliation.”xi

• While many think of Skype and Skype for Business as primarily a telephony solution, it includes a number of other capabilities that require retention of content: files that are transferred via instant messaging, video, shared whiteboard content, and persistent chat. Much of this content must be archived and retained just like any other ESI.

Compliance and Best Practices f or Deploying Skype for

B usiness SUMMARY Skype for Business is a leading business tool that will find wide adoption in organizations of all sizes. The content within it – voicemails, records of voice calls, instant messaging conversations, whiteboard-sharing sessions, and the like – will need to be monitored for compliance with corporate policy, regulatory and legal obligations; and content generated within Skype for Business deployments will need to be archived.

ABOUT ACTIANCE Actiance merged with Smarsh in 2018. Actiance products Alcatraz, Socialite and Vantage are now part of the Smarsh Connected Suite.

Actiance is the leader in communications compliance, archiving and analytics. We provide compliance across the broadest set of communications and social channels with insights on what’s being captured. Actiance customers manage over 500 million daily conversations across 70 channels and growing. Customers include the top 10 U.S., top 5 Canadian and top 8 European and top 3 Asian banks. The Actiance advantage is customers stay ahead of compliance and uncover patterns and relationships hidden within their data.!

Your journey into the future starts with Alcatraz, the archive for the NEXT 10 yearsTM. Alcatraz is the only archive built on the same elastic cloud technologies underlying today’s most popular consumer applications. This unique architecture allows you to ingest, search and export information 10 times faster than with traditional archives. C Alcatraz stores its content in a way that futureproofs the archive by allowing you to M capture any type of communication that exists today, and is architected to accept

Y other formats that are sure to exist in the future. It is the one and only ContextAwareTM archive that presents social communications sequentially threaded in CM near-native format. This makes it a breeze to review conversations, in context, rather MY than trying to make sense of disconnected conversations stored as emails.

CY To meet your regulatory requirements beyond retention, Socialite and Vantage let CMY you capture, control, and monitor email and all of your critical business

K communications. In addition, Vantage allows you to add disclaimers to outgoing messages, establish ethical walls and federate your communications with other organizations. Socialite also enhances your sellers’ ability to engage in social selling by allowing them to work directly on social media websites or an iOS application to engage with their network and to share content from a library. Actiance helps you manage Microsoft Exchange/O365, IBM Lotus Domino, and SMTP email as well as communications in the leading social media, unified communications, collaboration, and IM platforms provided by Facebook (FB), LinkedIn (LNKD), Twitter (TWTR), Google (GOOG), Yahoo! (YHOO), IBM (IBM), Jive (JIVE), Microsoft (MSFT), Cisco (C SCO) and Salesforce.com (CRM).

Compliance and Best Practices for Deploying Skype for

No part of this document may be reproduced in any form by any means, nor may it be distributed without the permission of Osterman Research, Inc., nor may it be resold or distributed by any entity other than Osterman Research, Inc., without prior written authorization of Osterman Research, Inc.

Osterman Research, Inc. does not provide legal advice. Nothing in this document constitutes legal advice, nor shall this document or any software product or other offering referenced herein serve as a substitute for the reader’s compliance with any laws (including but not limited to any act, statute, regulation, rule, directive, administrative order, executive order, etc. (collectively, “Laws”)) referenced in this document. If necessary, the reader should consult with competent legal counsel regarding any Laws referenced herein. Osterman Research, Inc. makes no representation or warranty regarding the completeness or accuracy of the information contained in this document.

THIS DOCUMENT IS PROVIDED “AS IS” WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL.

REFERENCES i https://blogs.office.com/2015/03/18/skype-for-business-is-here-and-this-is-only- the-beginning/ ii http://blog.videocall.co.uk/skype-for-business-–-whats-changed-for-skype-and-microsoft- lync-users iii https://blogs.office.com/2015/03/18/skype-for-business-is-here-and-this-is-only- the-beginning/ iv http://www.nojitter.com/post/240169483/cisco-vs-microsoft-the-collaboration- battle-continues v http://www.bizjournals.com/prnewswire/press_releases/2014/10/06/NY30877 vi Source: Inference of Attitudes from Nonverbal Communication in Two Channels, Dr. Albert Mehrabian vii http://about.americanexpress.com/news/docs/2011x/AXP_2011_csbar_market.pdf viii http://www.nojitter.com/slideshows/240169916/no-jitter-research-presents-skype- for-business-adoption-trends?pgno=1 ix http://www.joinvia.com/lync-bandwidth-calculator/ x http://www.businessinsider.com/wall-street-may-cut-out-voicemail-2015-6 xi http://abovethelaw.com/2015/03/voicemail-the-forgotten-form-of-esi-evidence/