Managing Records in SharePoint
Step 1: Develop Retention Rules that Work
Becky Bertram
MVP – Microsoft Most Valuable Professional
Independent SharePoint Consultant
becky@beckybertram.com
Marty Hansen
CIPP/IT
EVP Professional Services | Jordan Lawrence
mhansen@jordanlawrence.com
speakers
| Legal accepts
| Business understands
| You can implement
file plan with retention rules
| PURGE OBSOLETE INFORMATION
| REDUCE STORAGE COSTS
| DECREASE RISK
| POLICIES
| LAWS
| RETENTION STANDARDS
| CUT DISCOVERY COSTS
| REDUCE STORAGE COSTS
| IMPROVE EFFICIENCY
| DECREASE RISK
| FIND RECORDS
| CUT DISCOVERY COSTS
| IMPROVE EFFICIENCY
Compliance
Visibility
Eliminate Data
primary objectives
| Easy to use
| Little to no additional cost
| Facilitates retention and workflows
why sharepoint?
SharePoint
the catch
Create taxonomies by working
with business people to
organize documents and naming standards
to drive productivity.
Gartner, Inc.
file plan / taxonomy
RetentionWhat
Where
“SharePoint File Plan”
know your information
Who do you talk
to?
What questions
do you ask?
How do you set
standards?
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
? ? ? ? ?
where do you start?
Human Resources | Accounts Payable | Marketing | Finance
Audit | Fixed Assets | Sales | IT | Customer Service | Security
Quality | Shipping | Facilities | Logistics | Technology
Accounts Receivable | Benefits | Payroll | Employee Services
Risk Management | Compliance | Legal | Tax | Human Resources
Charitable Foundation | Corporate Communications
standards for business
Applicant Tracking | Audit Reports | Banking Records | Claims Files
Benefit Filings | Budget Records | Direct Mail | Compliance Records
Competitor Information | Contracts | Customer Information
General Ledger Records | Nonperforming Assets | Payroll Records
Order & Shipment Records | Advertising Records | Agency Contracts
Billing Statements | Brand Strategy | Brochures | Direct Mail | Forecasts
Intellectual Property Records | Marketing Research | Pricing Data
Public Relations Records | Trend Analysis | Vendor Contracts
Pricing Agreements | Property Tax Returns | Pension Records
Corporate Security Records | Fraud Files | Risk Rating Analysis
recognizable record types
MEDIA | Paper | Email | Unstructured | Paper | Applications
STORAGE LOCATIONS | PSTs | Forward to Personal Email
Laptop Hard Drive | External Hard Drive | Flash Drives
VERSIONs | Official Version | Convenience Copy
RETENTION | Business Needs | Current Retention | Industry
Standards | Best Practices | Regulatory Requirements
record type profiles
From the SDK: An information management
policy is a set of rules that govern the availability
and behavior of a certain type of important
content. Policy enables administrators to control
and evaluate who can access information, how
long to retain information, and how effectively
people are complying with the policy.
what is an information policy?
 Expiration/Retention Policies
 Auditing
 Bar Codes
 Document Labels
 Custom policies, such as preventing employees
from printing documents to printers
types of information policies
 In order for retention policies to be applied at the
library level, the Site Collection Feature called
Library and Folder Based Retention must be
activated
 Policies can be applied to Document Sets and
Records as well if the Document Sets and In
Place Records Management features are
activated at the Site Collection level
site collection features
 One policy can have multiple policy items, with each item
mapping to a type of policy functionality. For example:
Policy A has a policy item for document expiration and
another policy item that enables auditing.
 You can assign a single policy to a content type, whether
you’re assigning the policy to a content type defined in a
site collection or in a library.
 A Site Collection has a collection of policies. These pre-
configured policies can be applied to content types or
libraries.
policy framework
 A library can either be assigned a single policy or
each of the content types in that library can have
a policy assigned to them
 Unlike most content type properties, policies can
not be defined in both the site collection and at
the library level. It’s one or the other.
policies and libraries
Policy: Created
+1 Year
Site Collection
Policies
Site Collection
Content Types
Project Timeline
Policy: Created
+1 Year
Project
Deliverable
Policy: Modified
+1 Year
Project Documents
Library Content Types
Project Timeline
Policy: Created
+1 Year
Project
Deliverable
Policy: Modified
+1 Year
Project Scope
Policy: Created
+3 Years
(No policy)
Project Scope
Project Documents
Library Content Types
Policy: Created
+5 Years
Project Timeline
Policy: Created
+5 Years
Project
Deliverable
Policy: Created
+5 Years
Project Scope
Policy: Created
+5 Years
policy definition levels
It’s possible to exempt a particular document in a
library from the active retention policy
policy exemption
If you change a retention policy, all the items that
use that policy will immediately reflect the
changed policy
updating policy

Developing retention rules that work

  • 1.
    Managing Records inSharePoint Step 1: Develop Retention Rules that Work
  • 2.
    Becky Bertram MVP –Microsoft Most Valuable Professional Independent SharePoint Consultant becky@beckybertram.com Marty Hansen CIPP/IT EVP Professional Services | Jordan Lawrence mhansen@jordanlawrence.com speakers
  • 5.
    | Legal accepts |Business understands | You can implement file plan with retention rules
  • 6.
    | PURGE OBSOLETEINFORMATION | REDUCE STORAGE COSTS | DECREASE RISK | POLICIES | LAWS | RETENTION STANDARDS | CUT DISCOVERY COSTS | REDUCE STORAGE COSTS | IMPROVE EFFICIENCY | DECREASE RISK | FIND RECORDS | CUT DISCOVERY COSTS | IMPROVE EFFICIENCY Compliance Visibility Eliminate Data primary objectives
  • 7.
    | Easy touse | Little to no additional cost | Facilitates retention and workflows why sharepoint?
  • 8.
  • 9.
    Create taxonomies byworking with business people to organize documents and naming standards to drive productivity. Gartner, Inc. file plan / taxonomy
  • 10.
  • 11.
    Who do youtalk to? What questions do you ask? How do you set standards? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? ? where do you start?
  • 12.
    Human Resources |Accounts Payable | Marketing | Finance Audit | Fixed Assets | Sales | IT | Customer Service | Security Quality | Shipping | Facilities | Logistics | Technology Accounts Receivable | Benefits | Payroll | Employee Services Risk Management | Compliance | Legal | Tax | Human Resources Charitable Foundation | Corporate Communications standards for business
  • 13.
    Applicant Tracking |Audit Reports | Banking Records | Claims Files Benefit Filings | Budget Records | Direct Mail | Compliance Records Competitor Information | Contracts | Customer Information General Ledger Records | Nonperforming Assets | Payroll Records Order & Shipment Records | Advertising Records | Agency Contracts Billing Statements | Brand Strategy | Brochures | Direct Mail | Forecasts Intellectual Property Records | Marketing Research | Pricing Data Public Relations Records | Trend Analysis | Vendor Contracts Pricing Agreements | Property Tax Returns | Pension Records Corporate Security Records | Fraud Files | Risk Rating Analysis recognizable record types
  • 14.
    MEDIA | Paper| Email | Unstructured | Paper | Applications STORAGE LOCATIONS | PSTs | Forward to Personal Email Laptop Hard Drive | External Hard Drive | Flash Drives VERSIONs | Official Version | Convenience Copy RETENTION | Business Needs | Current Retention | Industry Standards | Best Practices | Regulatory Requirements record type profiles
  • 16.
    From the SDK:An information management policy is a set of rules that govern the availability and behavior of a certain type of important content. Policy enables administrators to control and evaluate who can access information, how long to retain information, and how effectively people are complying with the policy. what is an information policy?
  • 17.
     Expiration/Retention Policies Auditing  Bar Codes  Document Labels  Custom policies, such as preventing employees from printing documents to printers types of information policies
  • 18.
     In orderfor retention policies to be applied at the library level, the Site Collection Feature called Library and Folder Based Retention must be activated  Policies can be applied to Document Sets and Records as well if the Document Sets and In Place Records Management features are activated at the Site Collection level site collection features
  • 19.
     One policycan have multiple policy items, with each item mapping to a type of policy functionality. For example: Policy A has a policy item for document expiration and another policy item that enables auditing.  You can assign a single policy to a content type, whether you’re assigning the policy to a content type defined in a site collection or in a library.  A Site Collection has a collection of policies. These pre- configured policies can be applied to content types or libraries. policy framework
  • 20.
     A librarycan either be assigned a single policy or each of the content types in that library can have a policy assigned to them  Unlike most content type properties, policies can not be defined in both the site collection and at the library level. It’s one or the other. policies and libraries
  • 21.
    Policy: Created +1 Year SiteCollection Policies Site Collection Content Types Project Timeline Policy: Created +1 Year Project Deliverable Policy: Modified +1 Year Project Documents Library Content Types Project Timeline Policy: Created +1 Year Project Deliverable Policy: Modified +1 Year Project Scope Policy: Created +3 Years (No policy) Project Scope Project Documents Library Content Types Policy: Created +5 Years Project Timeline Policy: Created +5 Years Project Deliverable Policy: Created +5 Years Project Scope Policy: Created +5 Years policy definition levels
  • 22.
    It’s possible toexempt a particular document in a library from the active retention policy policy exemption
  • 23.
    If you changea retention policy, all the items that use that policy will immediately reflect the changed policy updating policy

Editor's Notes

  • #7 So why are you attending a session about managing records in SharePoint? Because you or someone in your organization feels that moving records into SharePoint will help you accomplish three common business objectives: |+| First, you need the visibility to find records when you need them. For many of you this means you feel the pain during discovery. For everyone else it’s basic efficiency. Using an accurate file plan using industry naming standards to move records into SharePoint will help you and your employees better organize information. |+| Second, to eliminate obsolete information to cut costs and reduce a host of risks. The amount of information at a typical company is growing at about 30% annually. And this explosive growth of information has really fueled the e-discovery industry. Information that’s available is discoverable, right? And since companies are storing enormous amounts of electronic information, when litigation occurs, there’s more information to search through and review. As a result, e-discovery costs have grown from zero dollars to 5 billion dollars since the year 2000. Who in this room is familiar with the term e-discovery? How many of you think that improving the process of e-discovery means keep everything forever and implementing the best search technology you can find? How many of you think that improving the process of e-discovery means getting organized to know what you have and where you have it, consolidating it into a single repository like SharePoint and implementing a systematic, defensible process for eliminating information that has reached its regulatory or business retention need so you can more easily find what you need? When done right, many of our clients have essentially eliminated e-discovery. It's not that they've eliminated the need to present responsive information, it's that they've eliminated the need to search file shares, desktops, laptops and backup tapes to find terabytes of over-retained, redundant data. Now how many of you think that implementing a systematic, defensible process for eliminating information that is signed off on by IT, Legal and Compliance might save your company lots of money and eliminate lots of potential risk? |+| But how are you going to eliminate information? I can guarantee you this. You will not convince your legal team to eliminate information unless you can prove to them that you either a) have the information accounted for in some other place in some other format, or b) you’re in compliance with any legal retention requirements. In addition you, or someone in in the IT department is unwilling to delete information because they've had too many requests from business people to recover some information they can no longer find. It's why IT people love policies. Because if they have retention rules that their business people have signed off on then, they can show them those rules in defense of not having information. But the interesting part about information meeting its legal retention requirements is that only 60% of records have a statutory retention driver. And those requirements are often ambiguous. Companies often have the misconception that they can simply implement their poorly designed or void of business-input retention schedules that they already have or they can buy an of the shelf or on the Internet set of regulatory retention requirements. But without knowing what the information is, what state it's in and how it's being used, regulatory requirements are often misconstrued or applied incorrectly. Some vendors just sell a list of regulatory retention requirements with little to no guidance on how to apply them, or which information they pertain to. Not to mention that 40% of records don't have statutory retention drivers and won't even be in purchased retention schedules. How can you determine the retention requirements for business need records without knowing the business. The fact of the matter is, developing retention rules is more art than science. How many of you regularly have meetings with your CIO, General Counsel or Chief Compliance Officers? Let's face it, as IT people, we don't often get the chance to talk with upper management. And if we do get the chance, we often talk IT-speak and they look for ways to end the conversation as quickly as possible. But now imagine if you start using words like cut costs, improve efficiencies and cut risks. Do you think they'll want to hear more? Of course they will.