Email Record: Rethinking security governance