To have an SEC-compliant solution, the namespace that contains the buckets to be used by all Enterprise Vault partitions must be configured as compliant.

When creating the namespace in the ECS Management UI, ensure that the Compliance option is enabled.

Figure 2.   Namespace creation

When using ECS buckets in a compliant ECS namespace to meet SEC 17-A4 requirements, be aware of the following potential issues when choosing between WORM and NON-WORM partition types.  

NON-WORM mode 

If you are setting an ECS Streamer partition to NON-WORM mode, Enterprise Vault will write objects with no retention period even if you are setting a retention period in the Enterprise Vault retention category. If you are using NON-WORM partitions, it is likely that you should not be using a compliant ECS namespace.

WORM mode

If you are using a compliant namespace, you must give a minimum of a 1-second retention to the bucket retention value. Therefore, you must set the following option after the Host IP address when creating the ECS Streamer partition:

ENABLE_WRITE_TEST

If you do not set this option, ECS Streamer will fail connectivity checking because it will create an object and then delete it as part of its checks. This create and delete activity will occur within 1 second and will fail, causing the connectivity check fail. 

Version 2.0.1 of the ECS Streamer driver checks to determine if a retention period has been set on the bucket. If a retention period has been set, the ECS Streamer does not perform the write test.

Later versions of the ECS Streamer driver reintroduced write check when there is bucket-level retention is set, but it now retries the operation to ensure that it is performed over a 1-second timeframe.

ECS bucket default retention setting

Create the bucket for the vault store in the compliant namespace.

Ensure that the bucket retention is set to a value that does not conflict with any Enterprise Vault retention category, ideally 1 second. The bucket retention must be set, or an error will occur when you attempt to create the bucket.

Take caution when setting the ECS bucket-level retention. Enterprise Vault expects to be able to delete expired content; although it cleanly handles deletion errors on content that is still under ECS retention, it posts an error in the Microsoft Windows event log.

If you are using a NON-WORM Enterprise Vault partition, do not apply ECS bucket-level retention. Enterprise Vault expects all the savesets written to the partition to have no retention.

Figure 3.   Bucket creation

Consider the interaction between Enterprise Vault and bucket-level retention if more than 1 second is used for Enterprise Vault partitions.