Companies that don’t have a full-featured enterprise content management (ECM) system in place had better get one and fast, according to Forrester Research. The consultancy says the advent of new rules – such as Sarbanes-Oxley -- are pushing the need for ECM systems, which provide for secure, auditable content storage, access and record retention.

If regulatory rules are underscoring your need for an ECM system, here are three low-cost steps you should consider:

1. Define your records retention policies. Before you go and buy a system, you should have a good idea of what you need that system to do, and that’s almost impossible if you haven’t first fleshed out your records retention policy. This means documenting what defines a record (electronic documents, physical files, e-mail), what the retention rules are and who is responsible for declaration.

2. Take advantage of existing content repositories. Most companies already have multiple repositories for unstructured content in place, and they should look to those first as a foundation for building a larger, access-sensitive central repository, Forrester said. Instead of keeping files in e-mail folders, start moving them to a central database with proper auditing, versioning and access controls.

3. Focus new investments on records-savvy ECM systems. Companies with no records management or content repositories in place will have to buy something. In those cases, it’s best to stick with an ECM vendor that supports records management, such as Documentum (recently bought up by EMC) and Open Text. Another less expensive alternative is to team up with other initiatives within your company that also require an enterprise content management system, such as corporate portals, Forrester said.