2. Today’s Agenda
Introduction
8 Things You Need for Successful
Records Management in SharePoint
How RecordLion Resolves Issues
Summary
Q & A
3. #1
“By failing to prepare, you are preparing to fail.”
- Benjamin Franklin
A. Record DeclarationOverview
B. Overview
C. SharePoint File Plan
D. RecordLion File Plan
Create and
ManageYour
File Plan
4. Record DeclarationOverview
Unclassified
• You know it exists
• No policies
Non Records
• Classified
• Potential Records
• Uniform Policies
• In Place
Records
• Manually Declared
• Auto Declared
• Formal Disposition
• In Place or Record
Center
Examples
• Classification Exceptions
• Personal Emails
• Unnecessary Documents
Examples
• Working Documents
• General Emails
• Records to be declared later
Examples
• Important Records
• Archived Records
• Emails moved to RMS
5. File Plan Overview
A document or a way to document the retention
schedules for all your information.
Your Records Manager should create and maintain your File
Plan
You must publish your File Plan
File Plans should include a trigger, retention period and
disposition information
Many File Plans also include security, privacy and location
6. SharePoint File Plan
File Plan andTaxonomy are the same
You can export a report
Information Policy Retention Feature:
Date Property forTrigger
RetentionTime Period
Retention Action
Need Help Getting Started?
http://blog.recordlion.com/file-plan-template/
No formal File Plan
No detailed audit reporting outside of
the Records Center
8. #2
A. Site Collections
B. Sites
C. Libraries
D. Folders
E. ContentTypes
F. Records Center
Create
Taxonomy
9. Organization
• Common security, privacy and administrative concerns
Site Collections
• Security can be applied by site but users still might know those sites exist
• Use to separate products, departmental groups or business units
• Best Practice: Subscribe to a ContentType Publishing Hub
Sites
• Do not use lists with attachments
• Avoid picture libraries
• Best Practice: avoid Item Level Security
Document Libraries
• Allows information policies to move with document
• UseContentType Publishing
• Best Practice: as few as possible
ContentTypes
10. What About the Records Center
Records or Non Active Documents
Enable Document IDs
Policies assigned to Libraries
Use the Content Organizer
11. #3
A. Content Organizer
B. Location Based Classification
C. TechnologyTo Consider
D. Issues
Design
Classification
12. Classification Overview
Classification assigns information to a specific class of content which should be related to
policies.
Creates defensible policy assignment
Simplifies searching
Reduces cost of eDiscovery
13. Content Organizer
• Route content based on
Metadata
• Metadata foldering (great for
handling case files)
http://blog.recordlion.com/sharepoint-content-organizer/
14. Location Based Classification
Drag and drop on browser
Drag and drop using Synced Libraries (also OneDrive Business)
Upload from library
Potential Governance Risk
15. Technologies to Consider
Meta Data
• File Names
• Folder Names
• EDMS Properties
• Document
Properties
Content
• “Reads” content
• Email
• Office Documents
• PDF
Visual
• Looks at pixels
• Images/Forms
• Patterns
Template
• Zones
• OCR
• Barcodes
• Images orText
16. Classification Issues
No Automatic Document Classification
• Meta Data Extraction
• Classification forContentTypes
No Email Classification
• Move to SharePoint?
• Leave in Exchange?
No Meta Data Classification
• Forces too many ContentTypes
18. #4
A. TheValue of Information
B. Information Management Policies
C. Site Retention
D. Issues
Create
Retention
Policies
19. Retention Overview
Retention is a component of a file plan. Specifically it specifies how long after an event
before disposition takes place.
What drives retention periods?
Industry regulations
FINRA, SOX
Corporate policies
Local, state and federal laws
IRS, DOL
File Plans should include a
cutoff event, retention
period and disposition
information
20. InformationValue Declines OverTime
Business Need Regulator Need (TAX) No Need
Information
Value
Office Documents
Product Research
Sales/Customer
HR
Financials
Messaging/Social
IT Cost
Risk
Risk-to-
Value Gap
Cost-to-
Value Gap
22. Site Based Retention
• New for SharePoint 2013
• Use with self-service site creation
• Site closure is a new concept – hidden but
not deleted yet
• When the site is delete then the site mailbox
is deleted from Exchange
23. Retention Issues
No Case Based Retention
• Need to dispose all related documents
(ex. Employee Files,Tax Records, Loan Files)
No Event Based Retention
• Required for cases
• Date column retention is not enough
• Custom policies require experienced developer
• Difficulty: HARD
25. #5
A. Review and Approval
B. Complete Destruction of Content
C. Transfer
D. AuditTrail and Reporting
Build
Disposition
Processes
26. Review and Approval
1. Create SharePointWorkflow(s)
User AD Groups
One step for each approval group
Difficulty: MEDIUM
2. Set StageAction toWorkflow
27. Complete Destruction of Information
Empty the Recycle Bin!
If Forensic Destruction is needed:
Use RBS (Remote Blob Storage)
Do NOT allow OneDrive for Business
What about your tape and other backups?
28. Transfers
SharePoint can transfer to other SharePoint locations
Moving from Active to Archive (for example)
Difficulty: HARD
Difficulty: HARD
Transfer outside of SharePoint
Transfer to NARA (National Archives)
29. AuditTrail and Reporting
Only Records Centers store enough audit information for disposition.
ContentAuditing
SharePoint does NOT have records management reporting capabilities.
SharePoint can export basic auditing to Excel Spreadsheets
This WILL slow your system down
31. #6
A. Records vs. Non Records
B. SharePoint vs. Exchange Retention
C. Moving Records to SharePoint
Consider
Email
Retention
32. Records vs. Non Records
Consider using Microsoft Exchange for Uniform Retention
Use for mailboxes
Use for folders
Move Records to SharePoint
Best to store similar records in the same location if possible
Non uniform retention is difficult in Microsoft Exchange
http://blog.recordlion.com/dawn-garcia-ward-what-to-do-about-emails/
33. SharePoint vs Exchange Retention
SharePoint
Policy driven based on Location or ContentType
Different types of data can share policies
Exchange
Retention is normally “uniform” across all Email
Retention tags are used for individual folders
Retention tags can be applied by users
Personal tags require an Exchange Enterprise
CAL
34. Moving Email Records to SharePoint
Exchange Server Based Solution
Custom solution to apply directly on Exchange Folders
Users will drag and drop Emails into folders
Custom Meta data is not possible
Outlook Client Based Solution
Outlook add-in to manually move
Outlook add-in to apply custom Meta data
Microsoft does NOT provide this capability
35. #7
What happened to the paperless office?
A. Organization
B. Considerations
Manage
Physical
Records
36. Organization
Match to Physical Locations
• Use Sites/Libraries/Folders
• By RecordType
• By Date (typically year)
• Organizational/Departmental
• Use stub file to designate
physical item
Use electronic filing structures
• Unify with electronic records
• Use Meta data to determine
location
• Use stub file to designate
physical item
37. Considerations
• Iron Mountain
• Recall
• The File Room
Do you need integration into commercial records centers
• Chain of Custody
• Request / Fulfill
Do you need to track files (boxes)?
• SharePoint solution is NOT for Physical Records Management
Produce Barcodes and Labels
39. #8
Legal holds in SharePoint work great… but can you find
the right information?
A. Classification
B. eDiscovery Center
C. Records Centers
Create Legal
Holds &
eDiscovery
40. Legal Holds Overview
Suspending the normal disposition of information when it is
reasonably expected.
Legal holds can protect you from spoliation fines or in some
cases, incarceration
Legal holds should suspend the information management
policies
Legal holds should lock information from further editing
Identifying the correct information is key to successful legal
holds
Legal holds are required for present and future information
41. eDiscovery Center
• Each is a new site in the eDiscovery Center
Cases = Sites
• eDiscovery Center is it’s own Site Collection
• Consider Security and Data Privacy
Search across Site Collections
• Find and Hold SharePoint items in Place
• Find Hold Exchange items in place
• Deleted items moved to a secure location
Identify and Hold
• Export SharePoint items
• Export Exchange items
Search and Export
42. Records Center
Search Items Only in Records Center
Hold Items Only in Records Center
In Place or Export
43. Considerations
Who will be allowed to create Legal Holds?
Who will be allowed to release Legal Holds?
Will you hold information In-Place or make copies?
What about your other Information?
44. CallTo Action
1. Create a File Plan
2. CreateTaxonomy
3. Determine Classification Process
4. Create Retention Policies
5. Create Disposition Processes
6. Determine Email Policies
7. Handle Physical Records
8. Create Legal Hold Processes and
eDiscovery Practices
RecordLion Can Help!
Creating a file plan is a joint effort from records managers, lawyers, compliance officers, and content managers. Even if you are not in a highly regulated industry, there could be general laws requiring your organization to keep records. You must evaluate the legal requirements that are specific to your organization.
Information Policy Retention feature uses stages with an action at the end of each stage. For example, you could define a two-stage retention policy on all documents in a specific library that deletes all previous versions of the document one year after the document is created, and declares the document to be a record five years after the document is created.
SP File Plan Report – can show the number of items in each stage of the file plan, along with a rollup of the retention policies on each node in the plan.
While it’s possible to use the SP disposition approval workflow and enable auditing on any document library, you cannot capture retention stage audit information outside of the Record Center.
OOTB Reporting – Record center provides detailed reporting for Expiration & Disposition of content in the site. You would need a SP developer to build reports outside of the Record Center if using an in-place strategy.
We resolve the problem by adding a formal file plan outside of the SharePoint Taxonomy. Our file plan includes policies and lifecycles to manage your information. Our centralized approach takes care of your information no matter where it lives.
You create a site collection to host sites that are going to have something in common. For example, the sites might be managed together or share common branding.
You create sites so that you can better present and secure related content. You can also have different features on different sites in your site collections. By publishing as a Content Type Hub through the Managed Metadata Service, a site’s content types can be sent to subscriber sites.
Document libraries are groups of files that you share with other users. SP provides most of its document management features through document libraries rather than lists with attachments. Regarding security, the best practice is to make the document library the lowest level of your security plan. Be sure to avoid the temptation of using Item Level Security since it will cause problems with large libraries.
Content types are a centralized, reusable way to manage columns, workflow, behavior and other settings in a document library. A content type links a document with columns or other information such as a retention policy.
You could call the Records Center an archive. It is a separate site collection that requires you to either move or copy records into it. If you need frequent access to a document after it becomes a record, then a hybrid approach might make sense. For example, you could keep records in place with active documents for two years and then move them to a records center when a project is completed.
There’s a lot of text and information on these slides. Some I may go through quick, but we’ll make it available after the call as well as the recording.
Available in SharePoint 2010, 2013 and Online
Once a document is uploaded, using its Meta data the SharePoint Content Organizer can send the document to a specific folder or automatically create a new folder.
For many SharePoint users, it is hard to know where to put a document when it is created. For administrators, it is hard to sort documents and then put them in the right location.
This type of classification works best when representing a well known structure, such as your physical records center, or for very simple types of information. It is very important for end users to place documents in the correct location.
Metadata classification engines match property values to rules.
Content classification engines crawl specific locations for documents and then read them to extract metadata or make classification decisions.
Visual classification engines use statistical formulas to match documents against a well known set of training documents.
Template classification engines use regions, barcodes or text to identify documents.
Regardless of technology used, documents should be classified correctly at least 85% of the time.
We resolve the problem using a metadata classification engine. A records manager can create rules for a record class. As documents are added from SharePoint they are classified based on the matching rules. It is possible for a user to specify the record class manually but that’s one more burden to place on your users.
Retention is about removing obsolete information.
While the value of information declines over time, the cost to manage it remains basically constant, so there is a widening gap as costs exceed value over time. Also, e-discovery risk increases as information ages and context is lost, so there is an even larger gap as value declines and risk increases. Equally important, if business people are drowning in their own data, they have a very difficult time actually getting value from information older than six months to a year!
New for SP 2013, compliance policies have been extended to sites. Even with good governance, SharePoint sites can proliferate and grow out of control. Sites are created as they are needed, but sites are rarely deleted.
You define site policies from the root site of a site collection by going to the Site Policies page from the Site Collection Administration menu.
You can configure a policy to close a site first and then delete it later according to schedule.
Site owners can also close a site by using the Site Closure and Deletion page.
If an Exchange mailbox is associated with a site, the mailbox is deleted from Exchange Server 2013 when the site is deleted.
We solve the problem by allowing you to create events that trigger retention actions. In this example, we have a case based record class with case files for employees. By creating event occurrences, you can specify an event happened on a given day for a specific target property and value.
There’s a lot of text and information on these slides. Some I may go through quick, but we’ll make it available after the call as well as the recording.
OOTB the SP Disposition Approval workflow only supports a “single approver” scenario. This works well for simple disposition processes.
However, most organizations eventually have a need to provide multiple approval groups process a disposition request.
You can accomplish this with a relatively simple SP workflow with one step of each approval group. Then you can configure a retention stage to use this new workflow.
While tape and backups are directly related to forensic destruction, if you have a need for forensic destruction be sure to not forget about destroying those tapes & backups, too.
We solve the disposition process problems of SharePoint with multiple group approvals and extensive reporting that can even be customized.
Admittedly, this presentation is about SharePoint but often our clients ask us about moving email to SharePoint.
Personal tags are a premium feature. Mailboxes with policies that contain these tags (or as a result of users adding the tags to their mailbox) require an Exchange Enterprise client access license (CAL).
We solve the problem with an Outlook Addin, allowing your users to send emails or attachments to SP.
A physical record in SP is only a placeholder or stub file for the actual record; it is not the physical object itself.
Again, the SP item is just a stub file. You will need processes to keep the SP item and the physical item in sync with each other according to your file plan.
For example -
Disposing of the stub file when the physical record has expired.
Handling record requests and fulfillments
Tracking custody chains
We solve the problem by providing a way to map your physical records center to containers. Then you can easily add a stub file into SP with our ribbon bar button and pick the container it belongs to manually or by scanning a barcode.
Amendments to the Federal Rules of Civil Procedure (FRCP) from December 1, 2006 require organizations to hold electronic records (in addition to physical records) until the legal matter was settled.
Just as important to find the information that should be held is the ability to eliminate information that is not relevant.
The eDiscovery in new for SharePoint 2013.
The eDiscovery Center is a central SharePoint site used to manage preservation, search, and export of content stored in Exchange and SharePoint across SharePoint farms and Exchange servers.
Again, thank you for attending today's webinar. Your follow up email will have a link to the recording. You can learn more about RecordLion or contact us through our website, www.recordlion.com. Feel free to reach out and let us know how we can help you.
